@openwop/cli 0.2.0 → 0.3.0

package/dist/cli.js

@@ -311,12 +311,12 @@ async function getWaSocket(env) {
       const { state, saveCreds } = await useMultiFileAuthState(authDir);
       const sock = makeWASocket({ auth: state, printQRInTerminal: true });
       sock.ev.on("creds.update", saveCreds);
-      await new Promise((resolve, reject) => {
+      await new Promise((resolve2, reject) => {
         const timer = setTimeout(() => reject(new Error("WhatsApp connection timed out (scan the QR within 90s, or check the linked session)")), 9e4);
         sock.ev.on("connection.update", (u) => {
           if (u?.connection === "open") {
             clearTimeout(timer);
-            resolve();
+            resolve2();
           }
         });
       });
@@ -393,9 +393,9 @@ async function getDiscordClient(env) {
           GatewayIntentBits.GuildMessageReactions
         ]
       });
-      const ready = new Promise((resolve) => {
-        client.once("clientReady", resolve);
-        client.once("ready", resolve);
+      const ready = new Promise((resolve2) => {
+        client.once("clientReady", resolve2);
+        client.once("ready", resolve2);
       });
       await client.login(token);
       await ready;
@@ -522,7 +522,7 @@ function errText(err) {
 }
 
 // src/constants.ts
-var VERSION = "0.2.0";
+var VERSION = "0.3.0";
 var DEFAULT_BASE_URL = "http://localhost:8080";
 var DEFAULT_REGISTRY_URL = "https://packs.openwop.dev";
 var DEFAULT_API_KEY = "sample-token";
@@ -1010,8 +1010,8 @@ function parseJsonResponse(text) {
 }
 
 // src/util.ts
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+function sleep(ms2) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms2));
 }
 
 // src/sse.ts
@@ -1200,19 +1200,19 @@ function defaultReadTurn(ctx) {
   rl.on("close", () => {
     closed = true;
   });
-  return (prompt) => new Promise((resolve) => {
+  return (prompt) => new Promise((resolve2) => {
     if (closed) {
-      resolve(null);
+      resolve2(null);
       return;
     }
     if (!ctx.json) ctx.io.stdout.write(prompt);
     const onLine = (line) => {
       rl.removeListener("close", onClose);
-      resolve(line);
+      resolve2(line);
     };
     const onClose = () => {
       rl.removeListener("line", onLine);
-      resolve(null);
+      resolve2(null);
     };
     rl.once("line", onLine);
     rl.once("close", onClose);
@@ -1568,8 +1568,10 @@ async function runWebhooksTest(ctx, argv) {
 
 // src/cli/cron.ts
 var CRON_HELP = `Usage:
-  openwop cron list [--json]
+  openwop cron list [--roster <rosterId>] [--json]
   openwop cron add "<cronExpr>" [--workflow <id>] [--job-id <id>] [--first-fire-at-ms <ms>] [--json]
+  openwop cron enable <jobId> [--json]
+  openwop cron disable <jobId> [--json]
   openwop cron remove <jobId> [--json]
   openwop cron trigger <jobId> [--json]
 
@@ -1577,16 +1579,21 @@ Manage scheduled (cron) jobs on the configured host via the RFC 0052 sample
 scheduler CRUD (/v1/host/sample/scheduler/jobs). This is a sample-extension
 surface \u2014 not part of the normative OpenWOP wire contract.
 
+  list     Lists jobs (tenant-scoped). --roster <id> filters to the schedules
+           owned by one roster member (?rosterId=).
   add      Registers a job. --job-id is optional (the host assigns a UUID when
            omitted). A --first-fire-at-ms beyond the host's maxFutureHorizon is
            rejected with schedule_horizon_exceeded (RFC 0052 \xA7B.3).
+  enable   Activates a job (PATCH {enabled:true}); its triggers fire again.
+  disable  Deactivates a job (PATCH {enabled:false}); the row stays but its
+           triggers are inert (mirrors the roster 'enabled' posture).
   trigger  Fires the job once now. Honors RFC 0052 \xA7B.2 fire-once-per-tick: a
            single trigger advances the scheduler clock one tick and produces
            exactly one run.
 `;
 async function runCron(ctx, argv) {
   const sub = argv[0] ?? "list";
-  const args = argv.slice(["list", "add", "remove", "rm", "trigger"].includes(sub) ? 1 : 0);
+  const args = argv.slice(["list", "add", "enable", "disable", "remove", "rm", "trigger"].includes(sub) ? 1 : 0);
   if (sub === "--help" || sub === "-h") {
     write(ctx.io.stdout, CRON_HELP);
     return 0;
@@ -1596,6 +1603,10 @@ async function runCron(ctx, argv) {
       return await runCronList(ctx, args);
     case "add":
       return await runCronAdd(ctx, args);
+    case "enable":
+      return await runCronSetEnabled(ctx, args, true);
+    case "disable":
+      return await runCronSetEnabled(ctx, args, false);
     case "remove":
     case "rm":
       return await runCronRemove(ctx, args);
@@ -1607,28 +1618,50 @@ Run \`openwop cron --help\` for usage.`);
   }
 }
 async function runCronList(ctx, argv) {
-  const { options } = parseOptions(argv, { bool: ["--help"] });
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--roster"] });
   if (options.help) {
     write(ctx.io.stdout, CRON_HELP);
     return 0;
   }
-  const res = await requestJson(ctx, "/v1/host/sample/scheduler/jobs");
+  const path = options.roster !== void 0 ? `/v1/host/sample/scheduler/jobs?rosterId=${encodeURIComponent(options.roster)}` : "/v1/host/sample/scheduler/jobs";
+  const res = await requestJson(ctx, path);
   if (ctx.json) {
     writeJson(ctx.io.stdout, res.body);
     return 0;
   }
   const jobs = Array.isArray(res.body?.jobs) ? res.body.jobs : [];
   if (jobs.length === 0) {
-    writeLine(ctx.io.stdout, 'No scheduled jobs. Add one with `openwop cron add "<cronExpr>" --workflow <id>`.');
+    writeLine(ctx.io.stdout, options.roster !== void 0 ? `No scheduled jobs for roster ${options.roster}.` : 'No scheduled jobs. Add one with `openwop cron add "<cronExpr>" --workflow <id>`.');
     return 0;
   }
   const rows = jobs.map((j) => ({
     jobId: j.jobId,
     cronExpr: j.cronExpr,
     workflowId: j.workflowId ?? "",
+    enabled: j.enabled === false ? "no" : "yes",
+    rosterId: j.rosterId ?? "",
     lastFiredTick: j.lastFiredTick ?? "-"
   }));
-  writeLine(ctx.io.stdout, formatTable(rows, ["jobId", "cronExpr", "workflowId", "lastFiredTick"]));
+  writeLine(ctx.io.stdout, formatTable(rows, ["jobId", "cronExpr", "workflowId", "enabled", "rosterId", "lastFiredTick"]));
+  return 0;
+}
+async function runCronSetEnabled(ctx, argv, enabled) {
+  const verb = enabled ? "enable" : "disable";
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, `Usage: openwop cron ${verb} <jobId> [--json]
+`);
+    return options.help ? 0 : 2;
+  }
+  const res = await requestJson(ctx, `/v1/host/sample/scheduler/jobs/${encodeURIComponent(positionals[0])}`, {
+    method: "PATCH",
+    body: { enabled }
+  });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `\u2713 ${enabled ? "Enabled" : "Disabled"} job ${res.body?.jobId ?? positionals[0]} (enabled: ${res.body?.enabled === false ? "false" : enabled ? "true" : "false"})`);
   return 0;
 }
 async function runCronAdd(ctx, argv) {
@@ -3574,10 +3607,10 @@ async function promptChoice(ctx, label, choices) {
 async function promptText(ctx, prompt, defaultValue = "") {
   ctx.io.stdout.write(prompt);
   const rl = createInterface3({ input: process.stdin, output: process.stdout, terminal: false });
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     rl.once("line", (line) => {
       rl.close();
-      resolve(line.length > 0 ? line : defaultValue);
+      resolve2(line.length > 0 ? line : defaultValue);
     });
   });
 }
@@ -3592,14 +3625,14 @@ async function readSecret(ctx, prompt) {
   const stdin = process.stdin;
   if (!stdin.isTTY) {
     const rl = createInterface3({ input: stdin, output: process.stdout, terminal: false });
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       rl.once("line", (line) => {
         rl.close();
-        resolve(line);
+        resolve2(line);
       });
     });
   }
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     stdin.setRawMode(true);
     stdin.resume();
     stdin.setEncoding("utf8");
@@ -3615,7 +3648,7 @@ async function readSecret(ctx, prompt) {
         const code = ch.charCodeAt(0);
         if (code === 13 || code === 10) {
           cleanup();
-          resolve(value);
+          resolve2(value);
           return;
         }
         if (code === 3) {
@@ -6179,6 +6212,222 @@ async function runDoctor(ctx, argv) {
   return checks.some((c) => c.status === "fail") ? 1 : 0;
 }
 
+// src/cli/governance.ts
+var GOV_BASE = "/v1/host/sample/governance";
+var ACTION_KINDS = ["email.send", "calendar.invite", "calendar.reschedule", "nudge"];
+var POLICY_VALUES = ["disabled", "draft-only", "approval-required"];
+var GOVERNANCE_HELP = `Usage:
+  openwop governance policy [get] [--json]
+  openwop governance policy set [--provider-allowlist <a,b,...>] [--action <kind=policy>]... [--retention-graph-days <n>] [--retention-source-days <n>] [--json]
+  openwop governance audit [--prefix <p>] [--limit <n>] [--since <iso>] [--json]
+
+Tenant governance administration (ADR 0028, host extension \u2014 superadmin-gated).
+Endpoints under ${GOV_BASE}:
+  GET  /policy   the tenant's stored policy + the host's declared defaults
+  PUT  /policy   upsert provider allowlist / per-action policy / retention (itself audited)
+  GET  /audit    the read view over the host audit log (assistant decisions, policy edits)
+
+CAPABILITY HONESTY: the HOST is the authority for every policy decision \u2014 this command
+only RENDERS the host's resolved view (stored values + the host's declared defaults). It
+never evaluates or asserts a policy outcome locally. Governance is a NON-NORMATIVE host
+extension (not advertised in /.well-known/openwop); if the host does not expose the surface
+the command fails closed legibly (exit 2) rather than guessing.
+
+Action kinds : ${ACTION_KINDS.join(", ")}
+Policy values: ${POLICY_VALUES.join(" | ")} (unset kinds fall back to the host's declared default)
+
+  --provider-allowlist L   Comma-separated provider ids the tenant may connect/resolve.
+                           Empty string restricts ALL providers; omit to leave unchanged.
+  --action <kind=policy>   Set one action kind's policy (repeatable).
+  --retention-graph-days N    Assistant-graph retention window (days).
+  --retention-source-days N   Source-derived retention window (days).
+  --prefix P               (audit) action-id prefix filter (host default: assistant.).
+  --limit N                (audit) max rows (host default: 100).
+  --since ISO              (audit) only rows at/after this ISO timestamp.
+
+Exit codes: 0 ok \xB7 2 usage error / surface not advertised / not authorized.
+
+Examples:
+  openwop governance policy
+  openwop governance policy get --json
+  openwop governance policy set --action email.send=approval-required --action nudge=disabled
+  openwop governance policy set --provider-allowlist anthropic,openai --retention-graph-days 90
+  openwop governance audit --prefix governance. --limit 20 --json
+`;
+async function govRequest(ctx, path, options) {
+  try {
+    return await requestJson(ctx, path, options);
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      throw new CliError(
+        "Host does not advertise governance administration (ADR 0028 host extension). Surface unavailable \u2014 failing closed.",
+        2
+      );
+    }
+    throw err;
+  }
+}
+async function runGovernance(ctx, argv) {
+  const sub = argv[0] ?? "policy";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, GOVERNANCE_HELP);
+    return 0;
+  }
+  switch (sub) {
+    case "policy":
+      return await runGovernancePolicy(ctx, argv.slice(1));
+    case "audit":
+      return await runGovernanceAudit(ctx, argv.slice(1));
+    // `get`/`set` at the top level are policy ops — lets the `policy` group alias
+    // read naturally (`openwop policy set ...`) without a redundant `policy policy`.
+    case "get":
+    case "set":
+      return await runGovernancePolicy(ctx, argv);
+    default:
+      throw new CliError(`Unknown governance command: ${sub}
+Run \`openwop governance --help\` for usage.`);
+  }
+}
+async function runGovernancePolicy(ctx, argv) {
+  const action = argv[0] === "set" ? "set" : "get";
+  const rest = argv[0] === "get" || argv[0] === "set" ? argv.slice(1) : argv;
+  return action === "set" ? await runPolicySet(ctx, rest) : await runPolicyGet(ctx, rest);
+}
+async function runPolicyGet(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, GOVERNANCE_HELP);
+    return 0;
+  }
+  const res = await govRequest(ctx, `${GOV_BASE}/policy`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const body = res.body ?? {};
+  const policy = body.policy ?? {};
+  const kinds = Array.isArray(body.actionKinds) ? body.actionKinds : [...ACTION_KINDS];
+  const defaultPolicy = body.defaults?.actionPolicy;
+  const stored = policy.actionPolicy ?? {};
+  writeLine(ctx.io.stdout, `Governance policy \u2014 tenant ${policy.tenantId ?? "(default)"}`);
+  writeLine(ctx.io.stdout, `Action policy (unset kinds default to '${defaultPolicy ?? "(host default)"}' \u2014 host-resolved):`);
+  const rows = kinds.map((k) => ({
+    kind: k,
+    policy: stored[k] ?? `(default \u2192 ${defaultPolicy ?? "?"})`
+  }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["kind", "policy"]));
+  const allowlist = policy.providerAllowlist;
+  const allowlistText = Array.isArray(allowlist) ? allowlist.length ? allowlist.join(", ") : "(empty \u2014 all providers blocked)" : "(unset \u2014 all providers allowed)";
+  writeLine(ctx.io.stdout, `Provider allowlist: ${allowlistText}`);
+  const retention = policy.retention;
+  if (retention && (retention.assistantGraphDays !== void 0 || retention.sourceDerivedDays !== void 0)) {
+    writeLine(ctx.io.stdout, `Retention: assistantGraphDays=${retention.assistantGraphDays ?? "\u2014"} sourceDerivedDays=${retention.sourceDerivedDays ?? "\u2014"}`);
+  } else {
+    writeLine(ctx.io.stdout, "Retention: (unset)");
+  }
+  if (policy.updatedAt) writeLine(ctx.io.stdout, `Updated: ${policy.updatedAt}${policy.updatedByUserId ? ` by ${policy.updatedByUserId}` : ""}`);
+  return 0;
+}
+async function runPolicySet(ctx, argv) {
+  const { options } = parseOptions(argv, {
+    bool: ["--help"],
+    value: ["--provider-allowlist", "--retention-graph-days", "--retention-source-days"],
+    multi: ["--action"]
+  });
+  if (options.help) {
+    write(ctx.io.stdout, GOVERNANCE_HELP);
+    return 0;
+  }
+  const body = {};
+  if (options.providerAllowlist !== void 0) {
+    body.providerAllowlist = String(options.providerAllowlist).split(",").map((p) => p.trim()).filter((p) => p.length > 0);
+  }
+  if (Array.isArray(options.action) && options.action.length) {
+    const actionPolicy = {};
+    for (const entry of options.action) {
+      const eq = String(entry).indexOf("=");
+      if (eq < 0) throw new CliError(`--action must be <kind=policy>, got '${entry}'`, 2);
+      const kind = entry.slice(0, eq).trim();
+      const policy2 = entry.slice(eq + 1).trim();
+      if (!ACTION_KINDS.includes(kind)) {
+        throw new CliError(`Unknown action kind '${kind}'. Known: ${ACTION_KINDS.join(", ")}`, 2);
+      }
+      if (!POLICY_VALUES.includes(policy2)) {
+        throw new CliError(`Policy for '${kind}' must be one of ${POLICY_VALUES.join(" | ")}`, 2);
+      }
+      actionPolicy[kind] = policy2;
+    }
+    body.actionPolicy = actionPolicy;
+  }
+  const retention = {};
+  for (const [flag, key] of [
+    ["retentionGraphDays", "assistantGraphDays"],
+    ["retentionSourceDays", "sourceDerivedDays"]
+  ]) {
+    if (options[flag] !== void 0) {
+      const n = Number(options[flag]);
+      if (!Number.isFinite(n) || n < 0) throw new CliError(`--${flag.replace(/[A-Z]/g, (m) => `-${m.toLowerCase()}`)} must be a non-negative number`, 2);
+      retention[key] = n;
+    }
+  }
+  if (Object.keys(retention).length) body.retention = retention;
+  if (Object.keys(body).length === 0) {
+    throw new CliError("Nothing to set \u2014 pass --provider-allowlist, --action, and/or --retention-*.", 2);
+  }
+  const res = await govRequest(ctx, `${GOV_BASE}/policy`, { method: "PUT", body });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const policy = res.body?.policy ?? {};
+  writeLine(ctx.io.stdout, `Updated governance policy for tenant ${policy.tenantId ?? "(default)"}.`);
+  if (policy.actionPolicy) {
+    for (const [k, v] of Object.entries(policy.actionPolicy)) writeLine(ctx.io.stdout, `  ${k} \u2192 ${v}`);
+  }
+  if (Array.isArray(policy.providerAllowlist)) {
+    writeLine(ctx.io.stdout, `  providerAllowlist: ${policy.providerAllowlist.length ? policy.providerAllowlist.join(", ") : "(empty \u2014 all blocked)"}`);
+  }
+  return 0;
+}
+async function runGovernanceAudit(ctx, argv) {
+  const { options } = parseOptions(argv, {
+    bool: ["--help"],
+    value: ["--prefix", "--limit", "--since"]
+  });
+  if (options.help) {
+    write(ctx.io.stdout, GOVERNANCE_HELP);
+    return 0;
+  }
+  const qs = new URLSearchParams();
+  if (options.prefix !== void 0) qs.set("actionPrefix", String(options.prefix));
+  if (options.limit !== void 0) {
+    const n = Number(options.limit);
+    if (!Number.isFinite(n) || n < 0) throw new CliError("--limit must be a non-negative number", 2);
+    qs.set("limit", String(n));
+  }
+  if (options.since !== void 0) qs.set("since", String(options.since));
+  const suffix = qs.toString() ? `?${qs.toString()}` : "";
+  const res = await govRequest(ctx, `${GOV_BASE}/audit${suffix}`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const items = Array.isArray(res.body?.items) ? res.body.items : [];
+  if (items.length === 0) {
+    writeLine(ctx.io.stdout, "No audit rows match (tenant-scoped; rows without a tenant stamp are withheld).");
+    return 0;
+  }
+  const rows = items.map((r) => ({
+    timestamp: r.timestamp ?? "",
+    principal: r.principalId ?? "",
+    action: r.action ?? "",
+    resource: r.resource ?? "",
+    outcome: r.outcome ?? ""
+  }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["timestamp", "principal", "action", "resource", "outcome"]));
+  return 0;
+}
+
 // src/cli/demo.ts
 import { spawn as spawn3, spawnSync as spawnSync5 } from "node:child_process";
 import { existsSync as existsSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync8, createReadStream, openSync as openSync2, statSync as statSync2, mkdirSync as mkdirSync6, rmSync as rmSync4, chmodSync as chmodSync4, watch } from "node:fs";
@@ -6459,7 +6708,7 @@ async function runDemoStart(ctx, argv) {
   };
   process.once("SIGINT", stop);
   process.once("SIGTERM", stop);
-  const exitCode = await new Promise((resolve) => {
+  const exitCode = await new Promise((resolve2) => {
     let settled = false;
     for (const { label, child } of children) {
       child.on("exit", (code, signal) => {
@@ -6468,7 +6717,7 @@ async function runDemoStart(ctx, argv) {
         if (signal) writeLine(ctx.io.stderr, `${label} stopped by ${signal}`);
         else writeLine(ctx.io.stderr, `${label} exited with ${code ?? 1}`);
         stop();
-        resolve(code ?? 1);
+        resolve2(code ?? 1);
       });
     }
   });
@@ -6555,7 +6804,7 @@ async function runDemoLogs(ctx, argv) {
   if (tail.length && !tail[tail.length - 1].endsWith("\n")) writeLine(ctx.io.stdout, "");
   if (!options.follow) return 0;
   let offset = Buffer.byteLength(existing, "utf8");
-  return await new Promise((resolve) => {
+  return await new Promise((resolve2) => {
     const emit = () => {
       let size;
       try {
@@ -6574,7 +6823,7 @@ async function runDemoLogs(ctx, argv) {
     const watcher = watch(logPath, { persistent: true }, emit);
     const finish = () => {
       watcher.close();
-      resolve(0);
+      resolve2(0);
     };
     process.once("SIGINT", finish);
     process.once("SIGTERM", finish);
@@ -6656,6 +6905,3635 @@ async function runDemoInstall(ctx, argv) {
   return 0;
 }
 
+// src/cli/approvals.ts
+var APPROVALS_HELP = `Usage:
+  openwop approvals list [--status pending|approved|rejected] [--json]
+  openwop approvals get <approvalId> [--json]
+  openwop approvals claim <approvalId> [--note <text>] [--json]
+  openwop approvals reject <approvalId> [--note <text>] [--json]
+
+The approval inbox \u2014 the human side of "agents propose, humans dispose". A
+review-mode roster member's heartbeat queues a proposal instead of starting the
+run; these commands let a human resolve it. A CLAIM is the affirmative act: it
+starts the proposed run (replay/fork/observability inherited). A REJECT dismisses
+the proposal so the heartbeat won't re-propose it.
+
+The host is the authority for every decision \u2014 the CLI renders the host's
+resolved queue and relays your claim/reject; it never decides locally. If the
+host does not advertise the approval surface (/.well-known/openwop), the group
+fails closed rather than guessing.
+
+Endpoints:
+  list    GET  /v1/host/sample/approvals[?status=...]
+  get     GET  /v1/host/sample/approvals   (filtered to <approvalId> client-side;
+          the host exposes no single-approval GET)
+  claim   POST /v1/host/sample/approvals/{id}/claim
+  reject  POST /v1/host/sample/approvals/{id}/reject
+
+  --status <s>   (list) Filter the queue: pending | approved | rejected (default: all).
+  --note <text>  (claim/reject) Optional human note recorded with the decision.
+  --json         Print the raw host response instead of the rendered view.
+
+Boundary: this is NOT \`interrupts\`. Interrupts are run-level HITL tokens you
+resolve to resume a paused run; approvals are the policy-gated proposal queue.
+
+Exit codes (get/claim/reject reflect the approval's resulting status, so scripts
+can gate on the verdict):
+  0  approved        3  pending        1  rejected (denied) or error
+\`list\` exits 0 on success.
+
+Examples:
+  openwop approvals list --status pending
+  openwop approvals get appr_123 --json
+  openwop approvals claim appr_123 --note "LGTM, ship it"
+  openwop approvals reject appr_123 --note "out of policy"
+`;
+var SUBCOMMANDS = ["list", "get", "claim", "reject", "approve", "deny"];
+async function runApprovals(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, APPROVALS_HELP);
+    return 0;
+  }
+  const args = argv.slice(SUBCOMMANDS.includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "list":
+      return await runApprovalsList(ctx, args);
+    case "get":
+      return await runApprovalsGet(ctx, args);
+    // `claim`/`reject` are the host's wire verbs; `approve`/`deny` are friendly aliases.
+    case "claim":
+    case "approve":
+      return await runApprovalsResolve(ctx, args, "claim");
+    case "reject":
+    case "deny":
+      return await runApprovalsResolve(ctx, args, "reject");
+    default:
+      throw new CliError(`Unknown approvals command: ${sub}
+Run \`openwop approvals --help\` for usage.`);
+  }
+}
+function exitForStatus(status) {
+  if (status === "approved") return 0;
+  if (status === "pending") return 3;
+  return 1;
+}
+async function ensureApprovalsAdvertised(ctx) {
+  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
+  if (!wk.ok) return;
+  const paths = wk.body && typeof wk.body === "object" ? wk.body.paths : void 0;
+  const advertised = paths !== null && typeof paths === "object" && Object.keys(paths).some((p) => p.startsWith("/v1/host/sample/approvals"));
+  if (!advertised) {
+    throw new CliError(
+      "approvals: this host does not advertise the approval-inbox surface (/v1/host/sample/approvals is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
+      1
+    );
+  }
+}
+function gate404(err) {
+  if (err instanceof HttpError && err.status === 404) {
+    const detail = err.body && typeof err.body === "object" && typeof err.body.message === "string" ? err.body.message : "not found";
+    throw new CliError(
+      `approvals: ${detail} (the host must mount /v1/host/sample/approvals; the CLI renders the host's queue, it never decides).`,
+      1
+    );
+  }
+  throw err;
+}
+async function fetchQueue(ctx, status) {
+  const path = status ? `/v1/host/sample/approvals?status=${encodeURIComponent(status)}` : "/v1/host/sample/approvals";
+  let res;
+  try {
+    res = await requestJson(ctx, path);
+  } catch (err) {
+    gate404(err);
+  }
+  return Array.isArray(res.body?.items) ? res.body.items : [];
+}
+async function runApprovalsList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--status"] });
+  if (options.help) {
+    write(ctx.io.stdout, APPROVALS_HELP);
+    return 0;
+  }
+  if (options.status !== void 0 && !["pending", "approved", "rejected"].includes(options.status)) {
+    throw new CliError("--status must be one of: pending, approved, rejected", 2);
+  }
+  await ensureApprovalsAdvertised(ctx);
+  const items = await fetchQueue(ctx, options.status);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, { items });
+    return 0;
+  }
+  if (items.length === 0) {
+    writeLine(ctx.io.stdout, `No approvals${options.status ? ` with status ${options.status}` : ""} on this host.`);
+    return 0;
+  }
+  const rows = items.map((a) => ({
+    approvalId: a.approvalId,
+    status: a.status,
+    kind: a.kind ?? (a.actionId ? "assistant-action" : "run-proposal"),
+    persona: a.persona ?? "",
+    proposal: truncate2(a.cardTitle ?? a.proposal ?? "", 40),
+    createdAt: a.createdAt ?? ""
+  }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["approvalId", "status", "kind", "persona", "proposal", "createdAt"]));
+  return 0;
+}
+async function runApprovalsGet(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop approvals get <approvalId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  await ensureApprovalsAdvertised(ctx);
+  const items = await fetchQueue(ctx);
+  const approval = items.find((a) => a.approvalId === positionals[0]);
+  if (!approval) {
+    throw new CliError(`approvals: no approval found with id ${positionals[0]}.`, 1);
+  }
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, approval);
+    return exitForStatus(approval.status);
+  }
+  writeLine(ctx.io.stdout, `approvalId: ${approval.approvalId}`);
+  writeLine(ctx.io.stdout, `status: ${approval.status}`);
+  writeLine(ctx.io.stdout, `kind: ${approval.kind ?? (approval.actionId ? "assistant-action" : "run-proposal")}`);
+  writeLine(ctx.io.stdout, `persona: ${approval.persona ?? ""}`);
+  if (approval.workflowId) writeLine(ctx.io.stdout, `workflowId: ${approval.workflowId}`);
+  if (approval.cardTitle) writeLine(ctx.io.stdout, `cardTitle: ${approval.cardTitle}`);
+  if (approval.proposal) writeLine(ctx.io.stdout, `proposal: ${approval.proposal}`);
+  writeLine(ctx.io.stdout, `createdAt: ${approval.createdAt ?? ""}`);
+  if (approval.resolvedAt) writeLine(ctx.io.stdout, `resolvedAt: ${approval.resolvedAt}`);
+  if (approval.runId) writeLine(ctx.io.stdout, `runId: ${approval.runId}`);
+  if (approval.note) writeLine(ctx.io.stdout, `note: ${approval.note}`);
+  return exitForStatus(approval.status);
+}
+async function runApprovalsResolve(ctx, argv, verb) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--note"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, `Usage: openwop approvals ${verb} <approvalId> [--note <text>] [--json]
+`);
+    return options.help ? 0 : 2;
+  }
+  await ensureApprovalsAdvertised(ctx);
+  const path = `/v1/host/sample/approvals/${encodeURIComponent(positionals[0])}/${verb}`;
+  const body = options.note !== void 0 ? { note: options.note } : void 0;
+  let res;
+  try {
+    res = await requestJson(ctx, path, { method: "POST", ...body !== void 0 ? { body } : {} });
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 409) {
+      const status = err.body?.status;
+      throw new CliError(`approvals: ${positionals[0]} is already ${status ?? "resolved"} \u2014 the host rejected a second decision.`, 1);
+    }
+    if (err instanceof HttpError && err.status === 422) {
+      const detail = err.body?.message ?? "proposal can no longer be acted on";
+      throw new CliError(`approvals: ${detail}`, 1);
+    }
+    gate404(err);
+  }
+  const out = res.body ?? {};
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, out);
+    return exitForStatus(out.status);
+  }
+  if (verb === "claim") {
+    writeLine(ctx.io.stdout, `\u2713 Claimed approval ${out.approvalId ?? positionals[0]} \u2192 ${out.status ?? "approved"}${out.runId ? ` (run ${out.runId})` : ""}${out.actionId ? ` (action ${out.actionId})` : ""}`);
+  } else {
+    writeLine(ctx.io.stdout, `\u2713 Rejected approval ${out.approvalId ?? positionals[0]} \u2192 ${out.status ?? "rejected"}`);
+  }
+  return exitForStatus(out.status ?? (verb === "claim" ? "approved" : "rejected"));
+}
+function truncate2(s, n) {
+  return s.length > n ? `${s.slice(0, n - 1)}\u2026` : s;
+}
+
+// src/cli/consent.ts
+var CONSENT_HELP = `Usage:
+  openwop consent policy <orgId> [--json]
+  openwop consent set-policy <orgId> [--default-mode opt-in|opt-out] [--regulated-region <r>]... [--json]
+  openwop consent records <orgId> [--json]
+  openwop consent get <orgId> <subjectKey> [--json]
+  openwop consent erase <orgId> <subjectKey> [--yes] [--json]
+  openwop consent public get <orgId> <subjectKey> [--json]
+  openwop consent public record <orgId> <subjectKey> [--category <name=bool>]... [--region <r>] [--json]
+
+Tenant-scoped consent (ADR 0020). The host is the authority: consent is stored
+per-tenant and the host resolves a subject's effective categories. This command
+RENDERS the host's resolved view \u2014 it never computes or asserts a consent outcome
+locally. The org\u2192tenant mapping and the per-tenant 'consent' feature toggle are
+enforced host-side; when the toggle is off the host returns a uniform 404 and this
+command fails closed with a legible message (it does not assume permissive).
+
+Authed, org-scoped (RBAC) \u2014 hits /v1/host/sample/consent/orgs/<orgId>/*:
+  policy        GET  .../policy        Show the tenant consent policy (defaultMode + regulated regions).
+  set-policy    PUT  .../policy        Update defaultMode and/or regulatedRegions (workspace:write).
+  records       GET  .../records       List all consent records for the tenant.
+  get           GET  .../subjects/<k>  Show one subject's consent record (or none).
+  erase         DEL  .../subjects/<k>  GDPR erasure \u2014 purge the record + fan out to feature erasers (idempotent).
+
+Public, unauthed \u2014 hits /v1/host/sample/public-consent/<orgId>:
+  public get    GET  .../<k>           Read a visitor's recorded categories, or the policy default if none.
+  public record POST .../             Record a visitor's category choices (source=public).
+
+  --default-mode <m>      (set-policy) opt-in | opt-out.
+  --regulated-region <r>  (set-policy) A regulated region code (repeatable; replaces the list).
+  --category <name=bool>  (public record) A category choice, e.g. analytics=true (repeatable).
+  --region <r>            (public record) The visitor's region.
+  --yes                   (erase) Confirm the destructive GDPR erasure.
+
+Exit codes: 0 success \xB7 1 host/HTTP error (incl. consent not enabled) \xB7 2 usage error.
+
+Examples:
+  openwop consent policy org_123
+  openwop consent set-policy org_123 --default-mode opt-out --regulated-region EU --regulated-region UK
+  openwop consent records org_123 --json
+  openwop consent get org_123 visitor-abc
+  openwop consent erase org_123 visitor-abc --yes
+  openwop consent public get org_123 visitor-abc
+  openwop consent public record org_123 visitor-abc --category analytics=true --category marketing=false
+`;
+var ORG_BASE = "/v1/host/sample/consent/orgs";
+var PUB_BASE = "/v1/host/sample/public-consent";
+async function consentRequest(ctx, path, options) {
+  try {
+    return await requestJson(ctx, path, options);
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      throw new CliError(
+        "consent unavailable: the host returned 404. Consent is gated on the org-tenant's `consent` feature toggle (uniform 404 when off) \u2014 verify the org exists and the host advertises/enables consent.",
+        1
+      );
+    }
+    throw err;
+  }
+}
+async function runConsent(ctx, argv) {
+  const sub = argv[0] ?? "";
+  if (sub === "--help" || sub === "-h" || sub === "") {
+    write(ctx.io.stdout, CONSENT_HELP);
+    return 0;
+  }
+  if (sub === "public") {
+    const psub = argv[1] ?? "";
+    const rest = argv.slice(2);
+    switch (psub) {
+      case "get":
+        return await runPublicGet(ctx, rest);
+      case "record":
+        return await runPublicRecord(ctx, rest);
+      default:
+        throw new CliError(`Unknown consent public command: ${psub || "(none)"}
+Run \`openwop consent --help\` for usage.`);
+    }
+  }
+  const args = argv.slice(1);
+  switch (sub) {
+    case "policy":
+      return await runPolicyGet2(ctx, args);
+    case "set-policy":
+      return await runSetPolicy(ctx, args);
+    case "records":
+      return await runRecords(ctx, args);
+    case "get":
+      return await runGet(ctx, args);
+    case "erase":
+      return await runErase(ctx, args);
+    default:
+      throw new CliError(`Unknown consent command: ${sub}
+Run \`openwop consent --help\` for usage.`);
+  }
+}
+function renderCategories(c) {
+  if (!c || typeof c !== "object") return "(none)";
+  return ["necessary", "analytics", "marketing"].map((k) => `${k}=${c[k] === true ? "yes" : "no"}`).join(" ");
+}
+async function runPolicyGet2(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop consent policy <orgId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await consentRequest(ctx, `${ORG_BASE}/${encodeURIComponent(positionals[0])}/policy`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const p = res.body?.policy ?? {};
+  writeLine(ctx.io.stdout, `tenantId: ${p.tenantId ?? ""}`);
+  writeLine(ctx.io.stdout, `defaultMode: ${p.defaultMode ?? "opt-in"}`);
+  writeLine(ctx.io.stdout, `regulatedRegions: ${Array.isArray(p.regulatedRegions) && p.regulatedRegions.length ? p.regulatedRegions.join(", ") : "(none)"}`);
+  return 0;
+}
+async function runSetPolicy(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, {
+    bool: ["--help"],
+    value: ["--default-mode"],
+    multi: ["--regulated-region"]
+  });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop consent set-policy <orgId> [--default-mode opt-in|opt-out] [--regulated-region <r>]... [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const body = {};
+  if (options.defaultMode !== void 0) {
+    if (options.defaultMode !== "opt-in" && options.defaultMode !== "opt-out") {
+      throw new CliError("--default-mode must be opt-in or opt-out", 2);
+    }
+    body.defaultMode = options.defaultMode;
+  }
+  if (Array.isArray(options.regulatedRegion)) body.regulatedRegions = options.regulatedRegion;
+  if (Object.keys(body).length === 0) throw new CliError("Nothing to set \u2014 pass --default-mode and/or --regulated-region.", 2);
+  const res = await consentRequest(ctx, `${ORG_BASE}/${encodeURIComponent(positionals[0])}/policy`, { method: "PUT", body });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const p = res.body?.policy ?? {};
+  writeLine(ctx.io.stdout, `Updated consent policy: defaultMode=${p.defaultMode ?? ""} regulatedRegions=${Array.isArray(p.regulatedRegions) && p.regulatedRegions.length ? p.regulatedRegions.join(", ") : "(none)"}`);
+  return 0;
+}
+async function runRecords(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop consent records <orgId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await consentRequest(ctx, `${ORG_BASE}/${encodeURIComponent(positionals[0])}/records`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const records = Array.isArray(res.body?.records) ? res.body.records : [];
+  if (records.length === 0) {
+    writeLine(ctx.io.stdout, "No consent records for this tenant.");
+    return 0;
+  }
+  const rows = records.map((r) => ({
+    subjectKey: r.subjectKey,
+    region: r.region ?? "",
+    categories: renderCategories(r.categories),
+    source: r.source ?? "",
+    ts: r.ts ?? ""
+  }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["subjectKey", "region", "categories", "source", "ts"]));
+  return 0;
+}
+async function runGet(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 2) {
+    write(ctx.io.stdout, "Usage: openwop consent get <orgId> <subjectKey> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const [orgId, subjectKey] = positionals;
+  const res = await consentRequest(ctx, `${ORG_BASE}/${encodeURIComponent(orgId)}/subjects/${encodeURIComponent(subjectKey)}`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const r = res.body?.record;
+  if (!r) {
+    writeLine(ctx.io.stdout, `No consent record for subject ${subjectKey}.`);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `subjectKey: ${r.subjectKey}`);
+  if (r.region) writeLine(ctx.io.stdout, `region: ${r.region}`);
+  writeLine(ctx.io.stdout, `categories: ${renderCategories(r.categories)}`);
+  writeLine(ctx.io.stdout, `source: ${r.source ?? ""}`);
+  writeLine(ctx.io.stdout, `ts: ${r.ts ?? ""}`);
+  if (r.expiresAt) writeLine(ctx.io.stdout, `expiresAt: ${r.expiresAt}`);
+  return 0;
+}
+async function runErase(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"] });
+  if (options.help || positionals.length !== 2) {
+    write(ctx.io.stdout, "Usage: openwop consent erase <orgId> <subjectKey> [--yes] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const [orgId, subjectKey] = positionals;
+  if (!options.yes) {
+    writeLine(ctx.io.stderr, `Refusing to erase subject ${subjectKey} (GDPR erasure is irreversible) without --yes.`);
+    return 2;
+  }
+  const res = await consentRequest(ctx, `${ORG_BASE}/${encodeURIComponent(orgId)}/subjects/${encodeURIComponent(subjectKey)}`, { method: "DELETE" });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const purged = res.body?.consentRecord === true;
+  writeLine(ctx.io.stdout, `Erased subject ${subjectKey} (consent record ${purged ? "purged" : "absent"}; downstream feature data erased).`);
+  return 0;
+}
+async function runPublicGet(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 2) {
+    write(ctx.io.stdout, "Usage: openwop consent public get <orgId> <subjectKey> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const [orgId, subjectKey] = positionals;
+  const res = await consentRequest(ctx, `${PUB_BASE}/${encodeURIComponent(orgId)}/${encodeURIComponent(subjectKey)}`, { auth: false });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const b = res.body ?? {};
+  writeLine(ctx.io.stdout, `recorded: ${b.recorded === true ? "yes" : "no"}`);
+  if (b.recorded !== true && b.defaultMode) writeLine(ctx.io.stdout, `defaultMode: ${b.defaultMode}`);
+  writeLine(ctx.io.stdout, `categories: ${renderCategories(b.categories)}`);
+  if (b.region) writeLine(ctx.io.stdout, `region: ${b.region}`);
+  return 0;
+}
+async function runPublicRecord(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, {
+    bool: ["--help"],
+    value: ["--region"],
+    multi: ["--category"]
+  });
+  if (options.help || positionals.length !== 2) {
+    write(ctx.io.stdout, "Usage: openwop consent public record <orgId> <subjectKey> [--category <name=bool>]... [--region <r>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const [orgId, subjectKey] = positionals;
+  const categories = {};
+  for (const entry of Array.isArray(options.category) ? options.category : []) {
+    const eq = entry.indexOf("=");
+    if (eq < 0) throw new CliError(`--category must be name=bool (got '${entry}')`, 2);
+    const name = entry.slice(0, eq);
+    const val = entry.slice(eq + 1).toLowerCase();
+    if (val !== "true" && val !== "false") throw new CliError(`--category value must be true or false (got '${entry}')`, 2);
+    categories[name] = val === "true";
+  }
+  const body = { subjectKey, categories };
+  if (options.region !== void 0) body.region = options.region;
+  const res = await consentRequest(ctx, `${PUB_BASE}/${encodeURIComponent(orgId)}`, { method: "POST", body, auth: false });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Recorded consent for ${subjectKey}: ${renderCategories(res.body?.categories)}`);
+  return 0;
+}
+
+// src/cli/mcp.ts
+var MCP_ENDPOINT = "/v1/host/sample/mcp";
+var rpcId = 0;
+var MCP_HELP = `Usage:
+  openwop mcp ping
+  openwop mcp info [--json]
+  openwop mcp tools [list] [--json]
+  openwop mcp tools call <name> [--args '{...}'] [--json]
+  openwop mcp resources [list] [--json]
+  openwop mcp resources templates [--json]
+  openwop mcp resources read <uri> [--json]
+  openwop mcp prompts [list] [--json]
+  openwop mcp prompts get <name> [--args '{...}'] [--json]
+
+MCP client for the host's JSON-RPC server mount (RFC 0020): a single JSON-RPC 2.0
+endpoint at POST ${MCP_ENDPOINT} speaking modelcontextprotocol.io 2025-06-18.
+This is a SAMPLE host extension (the /v1/host/sample/* prefix) \u2014 NOT part of the openwop
+wire contract and NOT advertised in /.well-known/openwop. The mount is HOST-CONTROLLED:
+env-gated (OPENWOP_MCP_SERVER_ENABLED) and OFF by default; the CLI cannot toggle it. When
+the mount is not exposed the endpoint 404s and these commands FAIL CLOSED legibly (exit 2)
+rather than guessing a surface.
+
+  info            'initialize' \u2014 server name/version, protocol version, advertised capabilities.
+  ping            'ping' \u2014 liveness probe of the mount (exit 0 if reachable).
+  tools list      'tools/list' \u2014 workflows exposed as MCP tools (name + inputSchema).
+  tools call      'tools/call' \u2014 invoke one exposed tool; exits 1 if the tool result isError.
+  resources list  'resources/list' \u2014 exposed resources (uri/name/mimeType).
+  resources templates  'resources/templates/list' \u2014 exposed URI templates.
+  resources read  'resources/read' \u2014 read one resource's contents by uri.
+  prompts list    'prompts/list' \u2014 exposed prompt templates.
+  prompts get     'prompts/get' \u2014 fetch one prompt's rendered messages.
+
+  --args J        (tools call / prompts get) JSON object passed as the call arguments.
+  --json          Emit the raw JSON-RPC result for any read.
+
+Exit codes: 0 ok \xB7 1 host/tool error \xB7 2 usage error / mount not available / invalid params.
+
+Examples:
+  openwop mcp ping
+  openwop mcp info --json
+  openwop mcp tools list
+  openwop mcp tools call sample.demo.uppercase --args '{"text":"hi"}'
+  openwop mcp resources read mcp://sample/readme
+  openwop mcp prompts get greet --args '{"name":"Ada"}' --json
+`;
+function rpcExit(code) {
+  return code === -32600 || code === -32601 || code === -32602 || code === -32700 ? 2 : 1;
+}
+async function mcpRpc(ctx, method, params) {
+  const body = { jsonrpc: "2.0", id: ++rpcId, method };
+  if (params !== void 0) body.params = params;
+  let res;
+  try {
+    res = await requestJson(ctx, MCP_ENDPOINT, { method: "POST", body });
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      throw new CliError(
+        `Host doesn't serve the MCP endpoint at ${MCP_ENDPOINT} (RFC 0020 sample mount, env-gated OPENWOP_MCP_SERVER_ENABLED \u2014 OFF by default). Failing closed.`,
+        2
+      );
+    }
+    throw err;
+  }
+  const rpc = res.body ?? {};
+  if (rpc && typeof rpc === "object" && rpc.error) {
+    const { code, message } = rpc.error;
+    throw new CliError(`MCP error ${code}: ${message ?? "unknown"}`, rpcExit(Number(code)));
+  }
+  return rpc.result ?? {};
+}
+async function runMcp(ctx, argv) {
+  const sub = argv[0] ?? "info";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, MCP_HELP);
+    return 0;
+  }
+  switch (sub) {
+    case "ping":
+      return await runPing(ctx, argv.slice(1));
+    case "info":
+    case "initialize":
+      return await runInfo(ctx, argv.slice(1));
+    case "tools":
+      return await runTools(ctx, argv.slice(1));
+    case "resources":
+      return await runResources(ctx, argv.slice(1));
+    case "prompts":
+      return await runPrompts2(ctx, argv.slice(1));
+    default:
+      throw new CliError(`Unknown mcp command: ${sub}
+Run \`openwop mcp --help\` for usage.`);
+  }
+}
+async function runPing(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, MCP_HELP);
+    return 0;
+  }
+  await mcpRpc(ctx, "ping");
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, { ok: true });
+    return 0;
+  }
+  writeLine(ctx.io.stdout, "MCP mount reachable (ping ok).");
+  return 0;
+}
+async function runInfo(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, MCP_HELP);
+    return 0;
+  }
+  const result = await mcpRpc(ctx, "initialize", {
+    protocolVersion: "2025-06-18",
+    clientInfo: { name: "openwop-cli", version: VERSION },
+    capabilities: {}
+  });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, result);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `server: ${result.serverInfo?.name ?? "(unknown)"} ${result.serverInfo?.version ?? ""}`.trimEnd());
+  writeLine(ctx.io.stdout, `protocolVersion: ${result.protocolVersion ?? "(unknown)"}`);
+  const caps = result.capabilities && typeof result.capabilities === "object" ? Object.keys(result.capabilities) : [];
+  writeLine(ctx.io.stdout, `capabilities: ${caps.length ? caps.join(", ") : "(none)"}`);
+  return 0;
+}
+async function runTools(ctx, argv) {
+  const action = argv[0] === "call" ? "call" : "list";
+  const rest = argv[0] === "list" || argv[0] === "call" ? argv.slice(1) : argv;
+  if (action === "call") return await runToolsCall(ctx, rest);
+  const { options } = parseOptions(rest, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, MCP_HELP);
+    return 0;
+  }
+  const result = await mcpRpc(ctx, "tools/list");
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, result);
+    return 0;
+  }
+  const tools = Array.isArray(result.tools) ? result.tools : [];
+  if (tools.length === 0) {
+    writeLine(ctx.io.stdout, "No tools exposed by the MCP mount.");
+    return 0;
+  }
+  const rows = tools.map((t) => ({ name: t.name, description: t.description ?? "" }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["name", "description"]));
+  return 0;
+}
+async function runToolsCall(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--args"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop mcp tools call <name> [--args '{...}'] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const params = { name: positionals[0] };
+  if (options.args !== void 0) {
+    try {
+      params.arguments = JSON.parse(options.args);
+    } catch {
+      throw new CliError("--args must be valid JSON", 2);
+    }
+  }
+  const result = await mcpRpc(ctx, "tools/call", params);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, result);
+    return result.isError ? 1 : 0;
+  }
+  const content = Array.isArray(result.content) ? result.content : [];
+  for (const c of content) {
+    if (c && c.type === "text") writeLine(ctx.io.stdout, String(c.text ?? ""));
+  }
+  return result.isError ? 1 : 0;
+}
+async function runResources(ctx, argv) {
+  const action = argv[0] === "templates" ? "templates" : argv[0] === "read" ? "read" : "list";
+  const rest = ["list", "templates", "read"].includes(argv[0]) ? argv.slice(1) : argv;
+  if (action === "read") return await runResourcesRead(ctx, rest);
+  const { options } = parseOptions(rest, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, MCP_HELP);
+    return 0;
+  }
+  const method = action === "templates" ? "resources/templates/list" : "resources/list";
+  const result = await mcpRpc(ctx, method);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, result);
+    return 0;
+  }
+  if (action === "templates") {
+    const templates = Array.isArray(result.resourceTemplates) ? result.resourceTemplates : [];
+    if (templates.length === 0) {
+      writeLine(ctx.io.stdout, "No resource templates exposed by the MCP mount.");
+      return 0;
+    }
+    const rows2 = templates.map((r) => ({ uriTemplate: r.uriTemplate, name: r.name ?? "", mimeType: r.mimeType ?? "" }));
+    writeLine(ctx.io.stdout, formatTable(rows2, ["uriTemplate", "name", "mimeType"]));
+    return 0;
+  }
+  const resources = Array.isArray(result.resources) ? result.resources : [];
+  if (resources.length === 0) {
+    writeLine(ctx.io.stdout, "No resources exposed by the MCP mount.");
+    return 0;
+  }
+  const rows = resources.map((r) => ({ uri: r.uri, name: r.name ?? "", mimeType: r.mimeType ?? "" }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["uri", "name", "mimeType"]));
+  return 0;
+}
+async function runResourcesRead(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop mcp resources read <uri> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const result = await mcpRpc(ctx, "resources/read", { uri: positionals[0] });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, result);
+    return 0;
+  }
+  const contents = Array.isArray(result.contents) ? result.contents : [];
+  for (const c of contents) {
+    if (c && typeof c.text === "string") writeLine(ctx.io.stdout, c.text);
+  }
+  return 0;
+}
+async function runPrompts2(ctx, argv) {
+  const action = argv[0] === "get" ? "get" : "list";
+  const rest = argv[0] === "list" || argv[0] === "get" ? argv.slice(1) : argv;
+  if (action === "get") return await runPromptsGet(ctx, rest);
+  const { options } = parseOptions(rest, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, MCP_HELP);
+    return 0;
+  }
+  const result = await mcpRpc(ctx, "prompts/list");
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, result);
+    return 0;
+  }
+  const prompts = Array.isArray(result.prompts) ? result.prompts : [];
+  if (prompts.length === 0) {
+    writeLine(ctx.io.stdout, "No prompts exposed by the MCP mount.");
+    return 0;
+  }
+  const rows = prompts.map((p) => ({
+    name: p.name,
+    description: p.description ?? "",
+    args: Array.isArray(p.arguments) ? String(p.arguments.length) : "0"
+  }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["name", "description", "args"]));
+  return 0;
+}
+async function runPromptsGet(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--args"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop mcp prompts get <name> [--args '{...}'] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const params = { name: positionals[0] };
+  if (options.args !== void 0) {
+    try {
+      params.arguments = JSON.parse(options.args);
+    } catch {
+      throw new CliError("--args must be valid JSON", 2);
+    }
+  }
+  const result = await mcpRpc(ctx, "prompts/get", params);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, result);
+    return 0;
+  }
+  if (result.description) writeLine(ctx.io.stdout, `description: ${result.description}`);
+  const messages = Array.isArray(result.messages) ? result.messages : [];
+  for (const m of messages) {
+    const text = m?.content?.type === "text" ? m.content.text : typeof m?.content === "string" ? m.content : JSON.stringify(m?.content);
+    writeLine(ctx.io.stdout, `[${m?.role ?? "?"}] ${text ?? ""}`);
+  }
+  return 0;
+}
+
+// src/cli/connections.ts
+var CONNECTIONS_HELP = `Usage:
+  openwop connections list [--json]
+  openwop connections get <connectionId> [--json]
+  openwop connections test <connectionId> [--json]
+  openwop connections authorize <provider> [--scope <s>]... [--write] [--return-to <url>] [--json]
+  openwop connections oauth-clients list [--json]
+  openwop connections oauth-clients get <provider> [--json]
+
+Inspect the host's third-party connections and their OAuth client configuration
+(ADR 0024). \`list\`/\`get\` render connection metadata + status; \`test\` health-probes
+one credential (the host refreshes OAuth on the way); \`authorize\` mints a consent
+URL for a provider \u2014 it returns the URL only, the CLI never completes the OAuth
+exchange. \`oauth-clients\` shows the host-configured OAuth apps (superadmin).
+
+SECRET BOUNDARY: client secrets and tokens are host-side and are NEVER returned,
+printed, or logged \u2014 only refs and status. The CLI additionally redacts any
+secret-looking field defensively before printing.
+
+The host is the authority \u2014 the CLI renders its resolved view and fails closed if
+the connections surface isn't advertised (/.well-known/openwop).
+
+Endpoints:
+  list           GET  /v1/host/sample/connections
+  get            GET  /v1/host/sample/connections  (filtered to <id> client-side;
+                 the host exposes no single-connection GET)
+  test           POST /v1/host/sample/connections/{id}/test
+  authorize      POST /v1/host/sample/connections/{provider}/authorize
+  oauth-clients  GET  /v1/host/sample/connections-oauth-clients[/{provider} filtered]
+
+  --scope <s>     (authorize) An OAuth scope to request (repeatable).
+  --write         (authorize) Request write scopes (re-consent for write access).
+  --return-to <u> (authorize) Where the host should bounce the browser back to.
+  --json          Print the (redacted) raw host response instead of the table.
+
+Exit codes:
+  list/get/authorize/oauth-clients  0 ok \xB7 2 usage \xB7 1 not-found/error
+  test                              0 connection healthy \xB7 1 unhealthy/error
+
+Examples:
+  openwop connections list
+  openwop connections get conn:abc --json
+  openwop connections test conn:abc
+  openwop connections authorize google --scope https://www.googleapis.com/auth/calendar --write
+  openwop connections oauth-clients list
+`;
+var SECRET_KEY = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential/i;
+function redact(value) {
+  if (Array.isArray(value)) return value.map(redact);
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = SECRET_KEY.test(k) ? "[redacted]" : redact(v);
+    }
+    return out;
+  }
+  return value;
+}
+var TOP = ["list", "get", "test", "authorize", "oauth-clients", "oauth-client"];
+async function runConnections(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, CONNECTIONS_HELP);
+    return 0;
+  }
+  const args = argv.slice(TOP.includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "list":
+      return await runList(ctx, args);
+    case "get":
+      return await runGet2(ctx, args);
+    case "test":
+      return await runTest(ctx, args);
+    case "authorize":
+      return await runAuthorize(ctx, args);
+    case "oauth-clients":
+    case "oauth-client":
+      return await runOAuthClients(ctx, args);
+    default:
+      throw new CliError(`Unknown connections command: ${sub}
+Run \`openwop connections --help\` for usage.`);
+  }
+}
+async function ensureAdvertised(ctx) {
+  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
+  if (!wk.ok) return;
+  const paths = wk.body && typeof wk.body === "object" ? wk.body.paths : void 0;
+  const advertised = paths !== null && typeof paths === "object" && Object.keys(paths).some((p) => p.startsWith("/v1/host/sample/connections"));
+  if (!advertised) {
+    throw new CliError(
+      "connections: this host does not advertise the connections surface (/v1/host/sample/connections is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
+      1
+    );
+  }
+}
+function gate4042(err) {
+  if (err instanceof HttpError && err.status === 404) {
+    const detail = err.body && typeof err.body === "object" && typeof err.body.message === "string" ? err.body.message : "not found";
+    throw new CliError(
+      `connections: ${detail} (the host must mount /v1/host/sample/connections; the CLI renders the host's view, it never holds credentials).`,
+      1
+    );
+  }
+  throw err;
+}
+function scopeAxis(c) {
+  if (c.orgId) return "org";
+  if (c.userId) return "user";
+  return "workspace";
+}
+async function fetchConnections(ctx) {
+  let res;
+  try {
+    res = await requestJson(ctx, "/v1/host/sample/connections");
+  } catch (err) {
+    gate4042(err);
+  }
+  return Array.isArray(res.body?.connections) ? res.body.connections : [];
+}
+async function runList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, CONNECTIONS_HELP);
+    return 0;
+  }
+  await ensureAdvertised(ctx);
+  const connections = (await fetchConnections(ctx)).map(redact);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, { connections });
+    return 0;
+  }
+  if (connections.length === 0) {
+    writeLine(ctx.io.stdout, "No connections on this host.");
+    return 0;
+  }
+  const rows = connections.map((c) => ({
+    connectionId: c.connectionId,
+    provider: c.provider,
+    kind: c.kind,
+    scope: scopeAxis(c),
+    status: c.status,
+    displayName: c.displayName ?? "",
+    expiresAt: c.expiresAt ?? ""
+  }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["connectionId", "provider", "kind", "scope", "status", "displayName", "expiresAt"]));
+  return 0;
+}
+async function runGet2(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop connections get <connectionId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  await ensureAdvertised(ctx);
+  const c = (await fetchConnections(ctx)).find((x) => x.connectionId === positionals[0]);
+  if (!c) {
+    throw new CliError(`connections: no connection found with id ${positionals[0]}.`, 1);
+  }
+  const safe = redact(c);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, safe);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `connectionId: ${safe.connectionId}`);
+  writeLine(ctx.io.stdout, `provider: ${safe.provider}`);
+  writeLine(ctx.io.stdout, `kind: ${safe.kind}`);
+  writeLine(ctx.io.stdout, `scope: ${scopeAxis(safe)}`);
+  writeLine(ctx.io.stdout, `status: ${safe.status}`);
+  if (safe.displayName) writeLine(ctx.io.stdout, `displayName: ${safe.displayName}`);
+  if (Array.isArray(safe.scopes)) writeLine(ctx.io.stdout, `scopes: ${safe.scopes.length ? safe.scopes.join(", ") : "(none)"}`);
+  if (safe.createdAt) writeLine(ctx.io.stdout, `createdAt: ${safe.createdAt}`);
+  if (safe.expiresAt) writeLine(ctx.io.stdout, `expiresAt: ${safe.expiresAt}`);
+  return 0;
+}
+async function runTest(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop connections test <connectionId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  await ensureAdvertised(ctx);
+  let res;
+  try {
+    res = await requestJson(ctx, `/v1/host/sample/connections/${encodeURIComponent(positionals[0])}/test`, { method: "POST" });
+  } catch (err) {
+    gate4042(err);
+  }
+  const result = redact(res.body ?? {});
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, result);
+    return result.ok === true ? 0 : 1;
+  }
+  writeLine(ctx.io.stdout, `connection: ${positionals[0]}`);
+  writeLine(ctx.io.stdout, `ok: ${result.ok === true ? "yes" : "no"}`);
+  writeLine(ctx.io.stdout, `status: ${result.status ?? "unknown"}`);
+  if (result.expiresAt) writeLine(ctx.io.stdout, `expiresAt: ${result.expiresAt}`);
+  if (result.detail) writeLine(ctx.io.stdout, `detail: ${result.detail}`);
+  return result.ok === true ? 0 : 1;
+}
+async function runAuthorize(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, {
+    bool: ["--help", "--write"],
+    value: ["--return-to"],
+    multi: ["--scope"]
+  });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop connections authorize <provider> [--scope <s>]... [--write] [--return-to <url>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  await ensureAdvertised(ctx);
+  const body = {};
+  if (Array.isArray(options.scope) && options.scope.length) body.scopes = options.scope;
+  if (options.write) body.write = true;
+  if (options.returnTo !== void 0) body.returnTo = options.returnTo;
+  let res;
+  try {
+    res = await requestJson(ctx, `/v1/host/sample/connections/${encodeURIComponent(positionals[0])}/authorize`, { method: "POST", body });
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 409) {
+      const detail = err.body?.message ?? `OAuth is not configured for '${positionals[0]}' on this host.`;
+      throw new CliError(`connections: ${detail}`, 1);
+    }
+    gate4042(err);
+  }
+  const out = redact(res.body ?? {});
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, out);
+    return 0;
+  }
+  if (!out.authorizeUrl) {
+    throw new CliError("connections: host did not return an authorizeUrl.", 1);
+  }
+  writeLine(ctx.io.stdout, out.authorizeUrl);
+  return 0;
+}
+async function runOAuthClients(ctx, argv) {
+  const action = argv[0] ?? "list";
+  if (action === "--help" || action === "-h") {
+    write(ctx.io.stdout, CONNECTIONS_HELP);
+    return 0;
+  }
+  const rest = argv.slice(["list", "get"].includes(action) ? 1 : 0);
+  if (action !== "list" && action !== "get") {
+    throw new CliError(`Unknown connections oauth-clients command: ${action}
+Run \`openwop connections --help\` for usage.`);
+  }
+  const { options, positionals } = parseOptions(rest, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, CONNECTIONS_HELP);
+    return 0;
+  }
+  await ensureAdvertised(ctx);
+  let res;
+  try {
+    res = await requestJson(ctx, "/v1/host/sample/connections-oauth-clients");
+  } catch (err) {
+    gate4042(err);
+  }
+  const clients = (Array.isArray(res.body?.clients) ? res.body.clients : []).map(redact);
+  if (action === "get") {
+    if (positionals.length !== 1) {
+      write(ctx.io.stdout, "Usage: openwop connections oauth-clients get <provider> [--json]\n");
+      return 2;
+    }
+    const client = clients.find((c) => c.provider === positionals[0]);
+    if (!client) {
+      throw new CliError(`connections: no OAuth client configured for provider ${positionals[0]}.`, 1);
+    }
+    if (ctx.json) {
+      writeJson(ctx.io.stdout, client);
+      return 0;
+    }
+    writeLine(ctx.io.stdout, `provider: ${client.provider}`);
+    writeLine(ctx.io.stdout, `clientId: ${client.clientId ?? ""}`);
+    writeLine(ctx.io.stdout, `configured: ${client.configured === true ? "yes" : "no"}`);
+    if (client.updatedAt) writeLine(ctx.io.stdout, `updatedAt: ${client.updatedAt}`);
+    if (client.updatedBy) writeLine(ctx.io.stdout, `updatedBy: ${client.updatedBy}`);
+    return 0;
+  }
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, { clients });
+    return 0;
+  }
+  if (clients.length === 0) {
+    writeLine(ctx.io.stdout, "No host OAuth clients configured.");
+    return 0;
+  }
+  const rows = clients.map((c) => ({
+    provider: c.provider,
+    clientId: c.clientId ?? "",
+    configured: c.configured === true ? "yes" : "no",
+    updatedAt: c.updatedAt ?? "",
+    updatedBy: c.updatedBy ?? ""
+  }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["provider", "clientId", "configured", "updatedAt", "updatedBy"]));
+  return 0;
+}
+
+// src/cli/profiles.ts
+var PROFILES_HELP = `Usage:
+  openwop profiles list [--json]
+  openwop profiles get [<userId>] [--json]            (omit userId for your own \u2014 same as 'me')
+  openwop profiles me [--json]
+  openwop profiles activity [--limit <n>] [--status <s>] [--json]
+  openwop profiles edit [--job-title <t>] [--department <t>] [--bio <t>] [--location <t>]
+                        [--equipment <x>]... [--interests <x>]...
+                        [--availability-status available|busy|away] [--timezone <tz>] [--hours-per-week <n>] [--json]
+  openwop profiles skills set --skill <name=proficiency>... [--json]
+  openwop profiles portfolio add --token <mediaToken> [--json]
+  openwop profiles portfolio remove <mediaToken> [--json]
+  openwop profiles pin <rosterId> [--json]
+  openwop profiles unpin <rosterId> [--json]
+  openwop profiles endorse <userId> <skill> [--json]
+  openwop profiles unendorse <userId> <skill> [--json]
+
+Self-service PERSONA: your job title, bio, contact, skills, availability, portfolio,
+and pinned agents (ADR 0005). The host is the authority and renders the resolved view \u2014
+reads are visible to any signed-in tenant member; writes only ever touch YOUR OWN profile
+(authority is intrinsic to the caller's resolved identity). Tenant-scoped throughout; a
+foreign-tenant id reads as 404. Requires a durable signed-in account (bearer via --api-key).
+
+BOUNDARY: \`profiles\` is the persona/skills surface, NOT the user directory (account
+lifecycle lives in the host's users surface) and NOT RBAC (that's \`orgs\`). \`profiles list\`
+is the persona directory of the tenant, not an account-management list.
+
+  --job-title/--department/--bio/--location   (edit) Text fields; pass empty string to clear.
+  --equipment/--interests <x>                 (edit) Repeatable; replaces the whole list.
+  --availability-status / --timezone / --hours-per-week  (edit) Availability sub-fields.
+  --skill <name=proficiency>                  (skills set) Repeatable; proficiency is 1..5. Replaces the skill list.
+  --token <mediaToken>                        (portfolio add) A tenant media-asset token (must be an image).
+  --limit <n> / --status <s>                  (activity) Page size (1..50) / run-status filter.
+
+Exit codes: 0 success \xB7 1 host/HTTP error (incl. not found / not signed in) \xB7 2 usage error.
+
+Examples:
+  openwop profiles me
+  openwop profiles get user_42 --json
+  openwop profiles edit --job-title "Staff Engineer" --availability-status busy --timezone Europe/London
+  openwop profiles skills set --skill TypeScript=5 --skill Rust=3
+  openwop profiles endorse user_42 TypeScript
+  openwop profiles pin r_123
+  openwop profiles activity --limit 10 --status failed
+`;
+var BASE = "/v1/host/sample/profiles";
+async function profilesRequest(ctx, path, options, notFoundMsg) {
+  try {
+    return await requestJson(ctx, path, options);
+  } catch (err) {
+    if (err instanceof HttpError) {
+      if (err.status === 401) {
+        throw new CliError("profiles requires a durable signed-in account \u2014 pass a bearer token via --api-key.", 1);
+      }
+      if (err.status === 404 && notFoundMsg) {
+        throw new CliError(notFoundMsg, 1);
+      }
+    }
+    throw err;
+  }
+}
+async function runProfiles(ctx, argv) {
+  const sub = argv[0] ?? "me";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, PROFILES_HELP);
+    return 0;
+  }
+  if (sub === "portfolio") {
+    const psub = argv[1] ?? "";
+    const rest = argv.slice(2);
+    if (psub === "add") return await runPortfolioAdd(ctx, rest);
+    if (psub === "remove") return await runPortfolioRemove(ctx, rest);
+    throw new CliError(`Unknown profiles portfolio command: ${psub || "(none)"}
+Run \`openwop profiles --help\` for usage.`);
+  }
+  if (sub === "skills") {
+    const psub = argv[1] ?? "";
+    if (psub === "set") return await runSkillsSet(ctx, argv.slice(2));
+    throw new CliError(`Unknown profiles skills command: ${psub || "(none)"}
+Run \`openwop profiles --help\` for usage.`);
+  }
+  const args = argv.slice(1);
+  switch (sub) {
+    case "list":
+      return await runList2(ctx, args);
+    case "get":
+      return await runGet3(ctx, args);
+    case "me":
+      return await runGet3(ctx, []);
+    // self
+    case "activity":
+      return await runActivity(ctx, args);
+    case "edit":
+      return await runEdit(ctx, args);
+    case "pin":
+      return await runPin(ctx, args, true);
+    case "unpin":
+      return await runPin(ctx, args, false);
+    case "endorse":
+      return await runEndorse(ctx, args, true);
+    case "unendorse":
+      return await runEndorse(ctx, args, false);
+    default:
+      throw new CliError(`Unknown profiles command: ${sub}
+Run \`openwop profiles --help\` for usage.`);
+  }
+}
+function renderProfile(ctx, p) {
+  const out = ctx.io.stdout;
+  const who = p.userId ?? "(unknown)";
+  writeLine(out, `user: ${p.displayName ? `${p.displayName} (${who})` : who}`);
+  if (p.jobTitle || p.department) writeLine(out, `role: ${[p.jobTitle, p.department].filter(Boolean).join(" \xB7 ")}`);
+  if (p.bio) writeLine(out, `bio: ${p.bio}`);
+  if (typeof p.completeness === "number") writeLine(out, `completeness: ${p.completeness}%`);
+  if (p.emailVerified !== void 0) writeLine(out, `emailVerified: ${p.emailVerified ? "yes" : "no"}`);
+  if (Array.isArray(p.skills) && p.skills.length) {
+    writeLine(out, `skills: ${p.skills.map((s) => `${s.name}(${s.proficiency})${Array.isArray(s.endorsements) && s.endorsements.length ? ` +${s.endorsements.length}` : ""}`).join(", ")}`);
+  }
+  if (p.availability && (p.availability.status || p.availability.timezone || p.availability.hoursPerWeek !== void 0)) {
+    const a = p.availability;
+    writeLine(out, `availability: ${[a.status, a.timezone, a.hoursPerWeek !== void 0 ? `${a.hoursPerWeek}h/wk` : ""].filter(Boolean).join(" \xB7 ")}`);
+  }
+  if (p.contact && (p.contact.location || Array.isArray(p.contact.links) && p.contact.links.length)) {
+    const c = p.contact;
+    if (c.location) writeLine(out, `location: ${c.location}`);
+    if (Array.isArray(c.links) && c.links.length) writeLine(out, `links: ${c.links.map((l) => `${l.label || l.url}${l.label && l.url ? ` <${l.url}>` : ""}`).join(", ")}`);
+  }
+  if (Array.isArray(p.equipment) && p.equipment.length) writeLine(out, `equipment: ${p.equipment.join(", ")}`);
+  if (Array.isArray(p.interests) && p.interests.length) writeLine(out, `interests: ${p.interests.join(", ")}`);
+  if (Array.isArray(p.workflows) && p.workflows.length) writeLine(out, `workflows: ${p.workflows.join(", ")}`);
+  if (Array.isArray(p.pinnedAgentIds) && p.pinnedAgentIds.length) writeLine(out, `pinnedAgents: ${p.pinnedAgentIds.join(", ")}`);
+  if (Array.isArray(p.portfolioAssetTokens) && p.portfolioAssetTokens.length) writeLine(out, `portfolio: ${p.portfolioAssetTokens.length} asset(s)`);
+  if (p.avatarAssetToken) writeLine(out, `avatar: set`);
+}
+async function runList2(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, "Usage: openwop profiles list [--json]\n");
+    return 0;
+  }
+  const res = await profilesRequest(ctx, BASE);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const profiles = Array.isArray(res.body?.profiles) ? res.body.profiles : [];
+  if (profiles.length === 0) {
+    writeLine(ctx.io.stdout, "No profiles in this tenant.");
+    return 0;
+  }
+  const rows = profiles.map((p) => ({
+    userId: p.userId,
+    name: p.displayName ?? "",
+    role: [p.jobTitle, p.department].filter(Boolean).join(" / "),
+    skills: Array.isArray(p.skills) ? String(p.skills.length) : "0",
+    complete: typeof p.completeness === "number" ? `${p.completeness}%` : ""
+  }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["userId", "name", "role", "skills", "complete"]));
+  return 0;
+}
+async function runGet3(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length > 1) {
+    write(ctx.io.stdout, "Usage: openwop profiles get [<userId>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const path = positionals.length === 1 ? `${BASE}/${encodeURIComponent(positionals[0])}` : `${BASE}/me`;
+  const res = await profilesRequest(ctx, path, void 0, `Profile not found: ${positionals[0] ?? "me"}`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  renderProfile(ctx, res.body ?? {});
+  return 0;
+}
+async function runActivity(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--limit", "--status"] });
+  if (options.help) {
+    write(ctx.io.stdout, "Usage: openwop profiles activity [--limit <n>] [--status <s>] [--json]\n");
+    return 0;
+  }
+  const qs = new URLSearchParams();
+  if (options.limit !== void 0) qs.set("limit", String(options.limit));
+  if (options.status !== void 0) qs.set("status", String(options.status));
+  const q = qs.toString();
+  const res = await profilesRequest(ctx, `${BASE}/me/activity${q ? `?${q}` : ""}`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const items = Array.isArray(res.body?.items) ? res.body.items : [];
+  if (items.length === 0) {
+    writeLine(ctx.io.stdout, "No recent activity.");
+    return 0;
+  }
+  const rows = items.map((it) => ({
+    runId: it.runId ?? "",
+    workflow: it.workflowId ?? it.workflow ?? "",
+    status: it.status ?? "",
+    when: it.createdAt ?? it.ts ?? ""
+  }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["runId", "workflow", "status", "when"]));
+  if (res.body?.truncated) writeLine(ctx.io.stdout, "(activity scan truncated \u2014 narrow with --status or --limit)");
+  return 0;
+}
+async function runEdit(ctx, argv) {
+  const { options } = parseOptions(argv, {
+    bool: ["--help"],
+    value: ["--job-title", "--department", "--bio", "--location", "--availability-status", "--timezone", "--hours-per-week"],
+    multi: ["--equipment", "--interests"]
+  });
+  if (options.help) {
+    write(ctx.io.stdout, PROFILES_HELP);
+    return 0;
+  }
+  const body = {};
+  if (options.jobTitle !== void 0) body.jobTitle = options.jobTitle;
+  if (options.department !== void 0) body.department = options.department;
+  if (options.bio !== void 0) body.bio = options.bio;
+  if (Array.isArray(options.equipment)) body.equipment = options.equipment;
+  if (Array.isArray(options.interests)) body.interests = options.interests;
+  if (options.location !== void 0) body.contact = { location: options.location };
+  const avail = {};
+  if (options.availabilityStatus !== void 0) {
+    if (!["available", "busy", "away"].includes(options.availabilityStatus)) {
+      throw new CliError("--availability-status must be one of available, busy, away", 2);
+    }
+    avail.status = options.availabilityStatus;
+  }
+  if (options.timezone !== void 0) avail.timezone = options.timezone;
+  if (options.hoursPerWeek !== void 0) {
+    const h = Number(options.hoursPerWeek);
+    if (!Number.isFinite(h)) throw new CliError("--hours-per-week must be a number", 2);
+    avail.hoursPerWeek = h;
+  }
+  if (Object.keys(avail).length) body.availability = avail;
+  if (Object.keys(body).length === 0) throw new CliError("Nothing to edit \u2014 pass at least one field.", 2);
+  const res = await profilesRequest(ctx, `${BASE}/me`, { method: "PATCH", body });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, "Updated your profile.");
+  renderProfile(ctx, res.body ?? {});
+  return 0;
+}
+async function runSkillsSet(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], multi: ["--skill"] });
+  if (options.help) {
+    write(ctx.io.stdout, "Usage: openwop profiles skills set --skill <name=proficiency>... [--json]\n");
+    return 0;
+  }
+  const entries = Array.isArray(options.skill) ? options.skill : [];
+  if (entries.length === 0) throw new CliError("Pass at least one --skill <name=proficiency>.", 2);
+  const skills = entries.map((e) => {
+    const eq = e.lastIndexOf("=");
+    if (eq < 0) throw new CliError(`--skill must be name=proficiency (got '${e}')`, 2);
+    const name = e.slice(0, eq).trim();
+    const prof = Number(e.slice(eq + 1));
+    if (!name) throw new CliError(`--skill name is required (got '${e}')`, 2);
+    if (!Number.isFinite(prof) || prof < 1 || prof > 5) throw new CliError(`--skill proficiency must be 1..5 (got '${e}')`, 2);
+    return { name, proficiency: prof };
+  });
+  const res = await profilesRequest(ctx, `${BASE}/me/skills`, { method: "PUT", body: { skills } });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Set ${skills.length} skill(s).`);
+  renderProfile(ctx, res.body ?? {});
+  return 0;
+}
+async function runPortfolioAdd(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--token"] });
+  if (options.help || options.token === void 0) {
+    write(ctx.io.stdout, "Usage: openwop profiles portfolio add --token <mediaToken> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await profilesRequest(ctx, `${BASE}/me/portfolio`, { method: "POST", body: { token: options.token } });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, "Added portfolio asset.");
+  return 0;
+}
+async function runPortfolioRemove(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop profiles portfolio remove <mediaToken> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await profilesRequest(ctx, `${BASE}/me/portfolio/${encodeURIComponent(positionals[0])}`, { method: "DELETE" }, `Portfolio asset not found: ${positionals[0]}`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, "Removed portfolio asset.");
+  return 0;
+}
+async function runPin(ctx, argv, pinned) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, `Usage: openwop profiles ${pinned ? "pin" : "unpin"} <rosterId> [--json]
+`);
+    return options.help ? 0 : 2;
+  }
+  const path = `${BASE}/me/pinned-agents/${encodeURIComponent(positionals[0])}`;
+  const res = await profilesRequest(ctx, path, { method: pinned ? "PUT" : "DELETE" }, `Agent not found: ${positionals[0]}`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `${pinned ? "Pinned" : "Unpinned"} agent ${positionals[0]}.`);
+  return 0;
+}
+async function runEndorse(ctx, argv, add) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 2) {
+    write(ctx.io.stdout, `Usage: openwop profiles ${add ? "endorse" : "unendorse"} <userId> <skill> [--json]
+`);
+    return options.help ? 0 : 2;
+  }
+  const [userId, skill] = positionals;
+  const path = `${BASE}/${encodeURIComponent(userId)}/skills/${encodeURIComponent(skill)}/endorse`;
+  const res = await profilesRequest(ctx, path, { method: add ? "POST" : "DELETE" }, `Profile or skill not found: ${userId} / ${skill}`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `${add ? "Endorsed" : "Removed endorsement for"} ${skill} on ${userId}.`);
+  return 0;
+}
+
+// src/cli/toggles.ts
+var TOGGLES_BASE = "/v1/host/sample/feature-toggles";
+var TOGGLES_HELP = `Usage:
+  openwop toggles list [--json]
+  openwop toggles get <toggleId> [--json]
+
+Render the caller's RESOLVED feature-toggle assignments (sample host extension under
+${TOGGLES_BASE}/assignments). This is a NON-NORMATIVE vendor surface \u2014 not part of the
+openwop wire contract and not advertised in /.well-known/openwop.
+
+CAPABILITY HONESTY (critical): the HOST is the sole authority for toggle/variant
+resolution \u2014 it runs server-side from the authenticated principal. This command only
+RENDERS the host's resolved view (status / enabled / variant / bindings, verbatim). It
+NEVER computes, asserts, or overrides a toggle decision locally, and it does not author
+config (the superadmin /admin/configs surface is intentionally not exposed here). If the
+host doesn't serve the surface the command fails closed legibly (exit 2).
+
+  list            'GET /assignments' \u2014 every toggle's resolved state for the caller (incl. off).
+  get <toggleId>  'GET /assignments/:id' \u2014 one toggle's resolved assignment.
+
+Resolved fields (host-authored): status (on | off | beta) \xB7 enabled (bool) \xB7 variant (key | none)
+\xB7 bindings (slot \u2192 ref@version for the assigned variant, when present).
+
+Exit codes: 0 ok \xB7 1 host error \xB7 2 usage error / surface not served / unknown toggle.
+
+Examples:
+  openwop toggles list
+  openwop toggles list --json
+  openwop toggles get crm.triageAgent
+`;
+async function togglesRequest(ctx, path) {
+  try {
+    return await requestJson(ctx, path);
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404 && path.endsWith("/assignments")) {
+      throw new CliError(
+        `Host does not serve the feature-toggle surface at ${TOGGLES_BASE} (non-normative host extension \u2014 not enabled). Failing closed.`,
+        2
+      );
+    }
+    throw err;
+  }
+}
+async function runToggles(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, TOGGLES_HELP);
+    return 0;
+  }
+  switch (sub) {
+    case "list":
+      return await runTogglesList(ctx, argv.slice(1));
+    case "get":
+      return await runTogglesGet(ctx, argv.slice(1));
+    default:
+      throw new CliError(`Unknown toggles command: ${sub}
+Run \`openwop toggles --help\` for usage.`);
+  }
+}
+async function runTogglesList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, TOGGLES_HELP);
+    return 0;
+  }
+  const res = await togglesRequest(ctx, `${TOGGLES_BASE}/assignments`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const assignments = Array.isArray(res.body?.assignments) ? res.body.assignments : [];
+  if (assignments.length === 0) {
+    writeLine(ctx.io.stdout, "No feature toggles resolved for this caller.");
+    return 0;
+  }
+  const rows = assignments.map((a) => ({
+    id: a.id,
+    status: a.status ?? "",
+    enabled: a.enabled === true ? "yes" : a.enabled === false ? "no" : "",
+    variant: a.variant ?? "\u2014",
+    bindings: Array.isArray(a.bindings) ? String(a.bindings.length) : "0"
+  }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["id", "status", "enabled", "variant", "bindings"]));
+  return 0;
+}
+async function runTogglesGet(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop toggles get <toggleId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  let res;
+  try {
+    res = await togglesRequest(ctx, `${TOGGLES_BASE}/assignments/${encodeURIComponent(positionals[0])}`);
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      throw new CliError(`No such feature toggle: ${positionals[0]}`, 2);
+    }
+    throw err;
+  }
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const a = res.body ?? {};
+  writeLine(ctx.io.stdout, `id: ${a.id ?? positionals[0]}`);
+  writeLine(ctx.io.stdout, `status: ${a.status ?? ""}`);
+  writeLine(ctx.io.stdout, `enabled: ${a.enabled === true ? "yes" : a.enabled === false ? "no" : ""}`);
+  writeLine(ctx.io.stdout, `variant: ${a.variant ?? "(none)"}`);
+  if (Array.isArray(a.bindings) && a.bindings.length) {
+    writeLine(ctx.io.stdout, "bindings:");
+    for (const b of a.bindings) {
+      const ref = b?.ref ?? {};
+      writeLine(ctx.io.stdout, `  ${b?.slot ?? "?"} \u2192 ${ref.kind ?? "?"}:${ref.name ?? "?"}@${ref.version ?? "?"}`);
+    }
+  }
+  return 0;
+}
+
+// src/cli/users.ts
+var USERS_BASE = "/v1/host/sample/users";
+var USER_SOURCES = ["oidc", "password", "saml", "scim", "manual"];
+var USERS_HELP = `Usage:
+  openwop users list [--json]
+  openwop users get <userId> [--json]
+  openwop users create --principal <id> [--email <e>] [--display-name <n>] [--group <g>]... [--source <s>] [--json]
+  openwop users update <userId> [--email <e>] [--display-name <n>] [--group <g>]... [--json]
+  openwop users disable <userId> [--json]
+  openwop users enable <userId> [--json]
+  openwop users delete <userId> [--yes]
+  openwop users me [--display-name <n>] [--json]
+
+Tenant identity DIRECTORY + account lifecycle (host users feature under ${USERS_BASE}).
+This is the durable record of WHO exists in a tenant and whether their account is active \u2014
+NOT authorization. Role/permission membership lives in \`orgs\` (RBAC); editable persona /
+self-profile lives in \`profiles\` and \`users me\`. The \`groups\` field here is the raw IdP
+\`groups[]\` captured at sign-in for the RBAC handoff \u2014 it does not itself grant anything.
+
+The host is the authority: every route resolves the caller's access server-side and the
+surface 404s when the users feature isn't served for them \u2014 these commands fail closed
+legibly (exit 2) rather than guessing. Lifecycle is fail-closed: a disabled account is
+denied (403), surfaced legibly.
+
+  --principal <id>    (create) The auth join key (e.g. oidc:<sub>) \u2014 required.
+  --email <e>         Email address; on update, '' clears it.
+  --display-name <n>  Display name; on update, '' clears it.
+  --group <g>         An IdP group name (repeatable). On update, replaces the set.
+  --source <s>        Identity source: ${USER_SOURCES.join(" | ")} (create; default manual).
+  --yes               (delete) Confirm the destructive removal.
+
+Exit codes: 0 ok \xB7 1 host error \xB7 2 usage error / surface not served / account disabled.
+
+Examples:
+  openwop users list
+  openwop users me
+  openwop users create --principal oidc:abc123 --email a@b.dev --group eng --source oidc
+  openwop users update u_1 --display-name "Ada L." --group eng --group oncall
+  openwop users disable u_1
+  openwop users delete u_1 --yes
+`;
+async function usersRequest(ctx, path, options) {
+  try {
+    return await requestJson(ctx, path, options);
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404 && !/\/users\/users\//.test(path)) {
+      throw new CliError(
+        `Host does not serve the users surface at ${USERS_BASE} (backend authority \u2014 not enabled for this caller). Failing closed.`,
+        2
+      );
+    }
+    throw err;
+  }
+}
+async function runUsers(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  const args = argv.slice(["list", "get", "create", "update", "disable", "enable", "delete", "me"].includes(sub) ? 1 : 0);
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, USERS_HELP);
+    return 0;
+  }
+  switch (sub) {
+    case "list":
+      return await runUsersList(ctx, args);
+    case "get":
+      return await runUsersGet(ctx, args);
+    case "create":
+      return await runUsersCreate(ctx, args);
+    case "update":
+      return await runUsersUpdate(ctx, args);
+    case "disable":
+    case "enable":
+      return await runUsersLifecycle(ctx, sub, args);
+    case "delete":
+      return await runUsersDelete(ctx, args);
+    case "me":
+      return await runUsersMe(ctx, args);
+    default:
+      throw new CliError(`Unknown users command: ${sub}
+Run \`openwop users --help\` for usage.`);
+  }
+}
+function userRow(u) {
+  return {
+    userId: u.userId,
+    principalId: u.principalId ?? "",
+    displayName: u.displayName ?? "",
+    source: u.source ?? "",
+    status: u.status ?? "",
+    groups: Array.isArray(u.groups) ? String(u.groups.length) : "0"
+  };
+}
+var USER_COLS = ["userId", "principalId", "displayName", "source", "status", "groups"];
+function printUser(ctx, u) {
+  writeLine(ctx.io.stdout, `userId: ${u.userId ?? ""}`);
+  writeLine(ctx.io.stdout, `principalId: ${u.principalId ?? ""}`);
+  if (u.email) writeLine(ctx.io.stdout, `email: ${u.email}`);
+  if (u.displayName) writeLine(ctx.io.stdout, `displayName: ${u.displayName}`);
+  writeLine(ctx.io.stdout, `source: ${u.source ?? ""}`);
+  writeLine(ctx.io.stdout, `status: ${u.status ?? ""}`);
+  writeLine(ctx.io.stdout, `groups: ${Array.isArray(u.groups) && u.groups.length ? u.groups.join(", ") : "(none)"}`);
+  if (u.createdAt) writeLine(ctx.io.stdout, `createdAt: ${u.createdAt}`);
+}
+async function runUsersList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, USERS_HELP);
+    return 0;
+  }
+  const res = await usersRequest(ctx, `${USERS_BASE}/users`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const users = Array.isArray(res.body?.users) ? res.body.users : [];
+  if (users.length === 0) {
+    writeLine(ctx.io.stdout, "No users in this tenant.");
+    return 0;
+  }
+  writeLine(ctx.io.stdout, formatTable(users.map(userRow), USER_COLS));
+  return 0;
+}
+async function runUsersGet(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop users get <userId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await usersRequest(ctx, `${USERS_BASE}/users/${encodeURIComponent(positionals[0])}`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  printUser(ctx, res.body ?? {});
+  return 0;
+}
+async function runUsersCreate(ctx, argv) {
+  const { options } = parseOptions(argv, {
+    bool: ["--help"],
+    value: ["--principal", "--email", "--display-name", "--source"],
+    multi: ["--group"]
+  });
+  if (options.help || !options.principal) {
+    write(ctx.io.stdout, "Usage: openwop users create --principal <id> [--email <e>] [--display-name <n>] [--group <g>]... [--source <s>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  if (options.source !== void 0 && !USER_SOURCES.includes(options.source)) {
+    throw new CliError(`--source must be one of ${USER_SOURCES.join(", ")}`, 2);
+  }
+  const body = { principalId: options.principal };
+  if (options.email !== void 0) body.email = options.email;
+  if (options.displayName !== void 0) body.displayName = options.displayName;
+  if (Array.isArray(options.group) && options.group.length) body.groups = options.group;
+  if (options.source !== void 0) body.source = options.source;
+  const res = await usersRequest(ctx, `${USERS_BASE}/users`, { method: "POST", body });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Created user ${res.body?.userId ?? ""} (${res.body?.principalId ?? options.principal}).`);
+  return 0;
+}
+async function runUsersUpdate(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, {
+    bool: ["--help"],
+    value: ["--email", "--display-name"],
+    multi: ["--group"]
+  });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop users update <userId> [--email <e>] [--display-name <n>] [--group <g>]... [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const body = {};
+  if (options.email !== void 0) body.email = options.email;
+  if (options.displayName !== void 0) body.displayName = options.displayName;
+  if (Array.isArray(options.group)) body.groups = options.group;
+  if (Object.keys(body).length === 0) {
+    throw new CliError("Nothing to update \u2014 pass --email, --display-name, and/or --group.", 2);
+  }
+  const res = await usersRequest(ctx, `${USERS_BASE}/users/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `Updated user ${positionals[0]}.`);
+  return 0;
+}
+async function runUsersLifecycle(ctx, verb, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, `Usage: openwop users ${verb} <userId> [--json]
+`);
+    return options.help ? 0 : 2;
+  }
+  const res = await usersRequest(ctx, `${USERS_BASE}/users/${encodeURIComponent(positionals[0])}/${verb}`, { method: "POST", body: {} });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `User ${positionals[0]} \u2192 ${res.body?.status ?? (verb === "disable" ? "disabled" : "active")}.`);
+  return 0;
+}
+async function runUsersDelete(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop users delete <userId> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) {
+    writeLine(ctx.io.stderr, `Refusing to delete user ${positionals[0]} without --yes.`);
+    return 2;
+  }
+  await usersRequest(ctx, `${USERS_BASE}/users/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+  writeLine(ctx.io.stdout, `Deleted user ${positionals[0]}.`);
+  return 0;
+}
+async function runUsersMe(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--display-name"] });
+  if (options.help) {
+    write(ctx.io.stdout, USERS_HELP);
+    return 0;
+  }
+  const method = options.displayName !== void 0 ? "PATCH" : "GET";
+  const reqOptions = method === "PATCH" ? { method: "PATCH", body: { displayName: options.displayName } } : void 0;
+  let res;
+  try {
+    res = await usersRequest(ctx, `${USERS_BASE}/me`, reqOptions);
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 403) {
+      throw new CliError("This account is disabled (host fail-closed, 403).", 2);
+    }
+    throw err;
+  }
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  printUser(ctx, res.body ?? {});
+  return 0;
+}
+
+// src/cli/workforces.ts
+var STATUSES = ["shadow", "piloting", "production"];
+var WORKFORCES_HELP = `Usage:
+  openwop workforces list [--json]
+  openwop workforces get <workforceId> [--json]
+  openwop workforces metrics <workforceId> [--json]
+  openwop workforces governance <workforceId> [--json]
+  openwop workforces migration <workforceId> [--json]
+  openwop workforces trace <workforceId> [--q <query>] [--json]
+  openwop workforces shadow <workforceId> [--json]
+  openwop workforces status <workforceId> <shadow|piloting|production> [--json]
+  openwop workforces eval <workforceId> [--json]
+
+Durable multi-agent orchestration at fleet scale (alias: \`fleet\`). A workforce is
+a governed bundle \u2014 agent specs, graduated-autonomy posture, and aggregate
+telemetry derived from its runs. \`status\` requests a cutover (the host gates
+promotion to \`production\` on the workforce having graduated to bounded-autonomous,
+and always allows rollback). \`eval\` runs a live shadow eval (host-gated capability).
+
+This group COMPOSES with \u2014 and does not duplicate \u2014 \`kanban\` (task boards) and
+\`roster\` (standing agents): it renders the workforce's governance/metrics view,
+never re-modelling boards or roster entries. The host is the authority; the CLI
+renders its resolved view and fails closed if the surface isn't advertised.
+
+Endpoints:
+  list        GET   /v1/host/sample/workforces
+  get         GET   /v1/host/sample/workforces/{id}
+  metrics     GET   /v1/host/sample/workforces/{id}/metrics
+  governance  GET   /v1/host/sample/workforces/{id}/governance
+  migration   GET   /v1/host/sample/workforces/{id}/migration
+  trace       GET   /v1/host/sample/workforces/{id}/trace[?q=]
+  shadow      GET   /v1/host/sample/workforces/{id}/shadow
+  status      PATCH /v1/host/sample/workforces/{id}   (body {status})
+  eval        POST  /v1/host/sample/workforces/{id}/eval
+
+  --q <query>   (trace) Match runs by correlationId / batchId / runId / outcome / status.
+  --json        Print the raw host response instead of the rendered view.
+
+Exit codes:
+  reads / status / eval   0 ok \xB7 2 usage \xB7 1 not-found / not-eligible / error
+
+Examples:
+  openwop workforces list
+  openwop fleet get wf_support --json
+  openwop workforces metrics wf_support
+  openwop workforces trace wf_support --q batch_42
+  openwop workforces status wf_support production
+`;
+var SUBCOMMANDS2 = ["list", "get", "metrics", "governance", "migration", "trace", "shadow", "status", "eval"];
+async function runWorkforces(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, WORKFORCES_HELP);
+    return 0;
+  }
+  const args = argv.slice(SUBCOMMANDS2.includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "list":
+      return await runWfList(ctx, args);
+    case "get":
+      return await runWfReadOne(ctx, args, "", renderWorkforce);
+    case "metrics":
+      return await runWfReadOne(ctx, args, "/metrics", renderMetrics);
+    case "governance":
+      return await runWfReadOne(ctx, args, "/governance", renderGovernance);
+    case "migration":
+      return await runWfReadOne(ctx, args, "/migration", renderMigration);
+    case "trace":
+      return await runWfTrace(ctx, args);
+    case "shadow":
+      return await runWfReadOne(ctx, args, "/shadow", renderShadow);
+    case "status":
+      return await runWfStatus(ctx, args);
+    case "eval":
+      return await runWfEval(ctx, args);
+    default:
+      throw new CliError(`Unknown workforces command: ${sub}
+Run \`openwop workforces --help\` for usage.`);
+  }
+}
+async function ensureAdvertised2(ctx) {
+  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
+  if (!wk.ok) return;
+  const paths = wk.body && typeof wk.body === "object" ? wk.body.paths : void 0;
+  const advertised = paths !== null && typeof paths === "object" && Object.keys(paths).some((p) => p.startsWith("/v1/host/sample/workforces"));
+  if (!advertised) {
+    throw new CliError(
+      "workforces: this host does not advertise the workforces surface (/v1/host/sample/workforces is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
+      1
+    );
+  }
+}
+function gate4043(err) {
+  if (err instanceof HttpError && err.status === 404) {
+    const detail = err.body && typeof err.body === "object" && typeof err.body.message === "string" ? err.body.message : "not found";
+    throw new CliError(
+      `workforces: ${detail} (the host must mount /v1/host/sample/workforces; the CLI renders the host's view, it never orchestrates locally).`,
+      1
+    );
+  }
+  throw err;
+}
+var num = (v) => typeof v === "number" ? String(v) : v == null ? "" : String(v);
+var pct = (v) => typeof v === "number" ? `${(v * 100).toFixed(1)}%` : "";
+var ms = (v) => typeof v === "number" ? `${Math.round(v)}ms` : "";
+async function runWfList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, WORKFORCES_HELP);
+    return 0;
+  }
+  await ensureAdvertised2(ctx);
+  let res;
+  try {
+    res = await requestJson(ctx, "/v1/host/sample/workforces");
+  } catch (err) {
+    gate4043(err);
+  }
+  const workforces = Array.isArray(res.body?.workforces) ? res.body.workforces : [];
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, { workforces });
+    return 0;
+  }
+  if (workforces.length === 0) {
+    writeLine(ctx.io.stdout, "No workforces on this host.");
+    return 0;
+  }
+  const rows = workforces.map((w) => ({
+    workforceId: w.workforceId,
+    name: w.name ?? "",
+    businessFunction: w.businessFunction ?? "",
+    status: w.status ?? "",
+    autonomy: w.autonomyLevel ?? "",
+    agents: Array.isArray(w.agents) ? String(w.agents.length) : "0"
+  }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["workforceId", "name", "businessFunction", "status", "autonomy", "agents"]));
+  return 0;
+}
+async function runWfReadOne(ctx, argv, suffix, render) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, WORKFORCES_HELP);
+    return options.help ? 0 : 2;
+  }
+  await ensureAdvertised2(ctx);
+  let res;
+  try {
+    res = await requestJson(ctx, `/v1/host/sample/workforces/${encodeURIComponent(positionals[0])}${suffix}`);
+  } catch (err) {
+    gate4043(err);
+  }
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  render(ctx, res.body ?? {}, positionals[0]);
+  return 0;
+}
+function renderWorkforce(ctx, w, id) {
+  writeLine(ctx.io.stdout, `workforceId: ${w.workforceId ?? id}`);
+  writeLine(ctx.io.stdout, `name: ${w.name ?? ""}`);
+  writeLine(ctx.io.stdout, `businessFunction: ${w.businessFunction ?? ""}`);
+  writeLine(ctx.io.stdout, `status: ${w.status ?? ""}`);
+  writeLine(ctx.io.stdout, `autonomyLevel: ${w.autonomyLevel ?? ""}`);
+  if (w.purpose?.statement) writeLine(ctx.io.stdout, `purpose: ${w.purpose.statement}`);
+  if (Array.isArray(w.successMetrics)) writeLine(ctx.io.stdout, `successMetrics: ${w.successMetrics.join(", ") || "(none)"}`);
+  if (Array.isArray(w.workflowCatalog)) writeLine(ctx.io.stdout, `workflowCatalog: ${w.workflowCatalog.join(", ") || "(none)"}`);
+  if (Array.isArray(w.agents)) {
+    writeLine(ctx.io.stdout, `agents (${w.agents.length}):`);
+    for (const a of w.agents) {
+      writeLine(ctx.io.stdout, `  \xB7 ${a.agentRef ?? "?"} [${a.role ?? "?"}] autonomy=${a.autonomyLevel ?? "?"}`);
+    }
+  }
+}
+function renderMetrics(ctx, m, id) {
+  writeLine(ctx.io.stdout, `workforceId: ${m.workforceId ?? id}`);
+  writeLine(ctx.io.stdout, `totalRuns: ${num(m.totalRuns)}  terminalRuns: ${num(m.terminalRuns)}  openApprovals: ${num(m.openApprovals)}`);
+  writeLine(ctx.io.stdout, `cycleTimeP50: ${ms(m.cycleTimeP50Ms)}  costPerCleared: ${m.costPerClearedUsd != null ? `$${m.costPerClearedUsd}` : ""}`);
+  writeLine(ctx.io.stdout, `escalationRate: ${pct(m.escalationRate)}  overrideRate: ${pct(m.overrideRate)}  falsePositiveRate: ${pct(m.falsePositiveRate)}  recoveryRate: ${pct(m.recoveryRate)}`);
+  writeLine(ctx.io.stdout, `policyViolations: ${num(m.policyViolations)}`);
+  if (m.source) writeLine(ctx.io.stdout, `source: ${m.source}`);
+}
+function renderGovernance(ctx, g, id) {
+  const a = g.autonomy ?? {};
+  const p = g.posture ?? {};
+  writeLine(ctx.io.stdout, `workforceId: ${a.workforceId ?? id}`);
+  writeLine(ctx.io.stdout, `currentTier: ${a.currentTier ?? "(none)"}  nextTier: ${a.nextTier ?? "(none)"}  eligibleForNext: ${a.eligibleForNext === true ? "yes" : "no"}`);
+  if (a.nextThreshold != null) writeLine(ctx.io.stdout, `nextThreshold: ${num(a.nextThreshold)}  recentOverrideIncidence: ${pct(a.recentOverrideIncidence)}`);
+  writeLine(ctx.io.stdout, `posture \u2014 overrides: ${num(p.overrides)}  escalations: ${num(p.escalations)}  falsePositives: ${num(p.falsePositives)}  recoveries: ${num(p.recoveries)}  policyViolations: ${num(p.policyViolations)}`);
+  if (g.source) writeLine(ctx.io.stdout, `source: ${g.source}`);
+}
+function renderMigration(ctx, j, id) {
+  writeLine(ctx.io.stdout, `workforceId: ${j.workforceId ?? id}`);
+  const stages = Array.isArray(j.stages) ? j.stages : [];
+  if (stages.length === 0) {
+    writeJson(ctx.io.stdout, j);
+    return;
+  }
+  for (const s of stages) {
+    writeLine(ctx.io.stdout, `  \xB7 ${s.key ?? s.stage ?? "?"}: ${s.status ?? "?"}`);
+  }
+}
+function renderShadow(ctx, s, id) {
+  writeLine(ctx.io.stdout, `workforceId: ${s.workforceId ?? id}`);
+  for (const [k, v] of Object.entries(s)) {
+    if (k === "workforceId") continue;
+    if (v == null || typeof v === "object") continue;
+    writeLine(ctx.io.stdout, `${k}: ${String(v)}`);
+  }
+}
+async function runWfTrace(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--q"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop workforces trace <workforceId> [--q <query>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  await ensureAdvertised2(ctx);
+  const q = options.q !== void 0 ? `?q=${encodeURIComponent(options.q)}` : "";
+  let res;
+  try {
+    res = await requestJson(ctx, `/v1/host/sample/workforces/${encodeURIComponent(positionals[0])}/trace${q}`);
+  } catch (err) {
+    gate4043(err);
+  }
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const matches = Array.isArray(res.body?.matches) ? res.body.matches : [];
+  if (matches.length === 0) {
+    writeLine(ctx.io.stdout, `No trace matches for ${positionals[0]}${options.q ? ` (q=${options.q})` : ""}.`);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, formatTable(
+    matches.map((m) => ({ runId: m.runId ?? "", status: m.status ?? "", outcome: m.outcome ?? "", createdAt: m.createdAt ?? m.atIso ?? "" })),
+    ["runId", "status", "outcome", "createdAt"]
+  ));
+  return 0;
+}
+async function runWfStatus(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 2) {
+    write(ctx.io.stdout, "Usage: openwop workforces status <workforceId> <shadow|piloting|production> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const [id, status] = positionals;
+  if (!STATUSES.includes(status)) {
+    throw new CliError(`status must be one of: ${STATUSES.join(", ")}`, 2);
+  }
+  await ensureAdvertised2(ctx);
+  let res;
+  try {
+    res = await requestJson(ctx, `/v1/host/sample/workforces/${encodeURIComponent(id)}`, { method: "PATCH", body: { status } });
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 409) {
+      const detail = err.body?.message ?? "cutover not eligible";
+      throw new CliError(`workforces: ${detail}`, 1);
+    }
+    gate4043(err);
+  }
+  const out = res.body ?? {};
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, out);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `\u2713 ${out.workforceId ?? id} \u2192 status ${out.status ?? status}`);
+  return 0;
+}
+async function runWfEval(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop workforces eval <workforceId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  await ensureAdvertised2(ctx);
+  let res;
+  try {
+    res = await requestJson(ctx, `/v1/host/sample/workforces/${encodeURIComponent(positionals[0])}/eval`, { method: "POST" });
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 501) {
+      const detail = err.body?.message ?? "this host does not enable the agent eval suite";
+      throw new CliError(`workforces: ${detail}`, 1);
+    }
+    gate4043(err);
+  }
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const s = res.body ?? {};
+  writeLine(ctx.io.stdout, `eval complete for ${positionals[0]}`);
+  for (const [k, v] of Object.entries(s)) {
+    if (v == null || typeof v === "object") continue;
+    writeLine(ctx.io.stdout, `${k}: ${String(v)}`);
+  }
+  return 0;
+}
+
+// src/cli/auth.ts
+var AUTH_HELP = `Usage:
+  openwop auth status [--json]
+  openwop auth saml metadata [--json]
+  openwop auth saml login-url [--return-to <path>] [--json]
+  openwop auth saml validate --idp-url <url> --variant <name> [--json]
+  openwop auth scim provision --op <create-user|assign-group|deactivate-user>
+                              [--user-name <u>] [--external-id <id>] [--email <e>] [--display-name <n>] [--group <g>] [--json]
+
+Enterprise identity-provider configuration (RFC 0050): SAML 2.0 SSO + SCIM 2.0
+provisioning. The host is the authority \u2014 this command surfaces status, public SP
+metadata, and provisioning results; every auth surface 404s when the host has not
+configured it (SAML/SCIM are env-gated host-side), and the command fails closed
+legibly in that case.
+
+SECRET BOUNDARY (critical): SAML signing certs, SCIM bearer tokens, and client
+secrets are HOST-SIDE only \u2014 they are never returned, printed, or logged. The CLI
+additionally runs every host response through a recursive redactor before printing,
+so a secret-looking field can never leak even if a host returns one by mistake.
+(SP metadata XML is the exception \u2014 it is PUBLIC by design, meant to be uploaded to
+your IdP, and contains only the SP's public certificate.)
+
+BOUNDARY: \`auth\` is SSO/SAML/SCIM identity-provider config (hits /v1/host/sample/auth/*).
+It is NOT the user directory (\`users\`), NOT RBAC (\`orgs\`), and NOT BYOK provider
+credentials (\`byok\`/\`providers\`).
+
+Subcommands \u2192 endpoint:
+  status        GET  /.well-known/openwop + probe   Which auth profiles this host advertises/serves.
+  saml metadata GET  /auth/saml/sso/metadata        SP metadata XML (upload to your IdP).
+  saml login-url GET /auth/saml/sso/login           The SP-initiated IdP redirect URL (not followed).
+  saml validate POST /auth/saml/validate            Conformance seam: validate a synthetic-IdP assertion.
+  scim provision POST /auth/scim/provision          Provisioning seam: create/assign-group/deactivate.
+
+  --return-to <path>   (saml login-url) Same-site return path after login (default /).
+  --idp-url <url>      (saml validate) The operator-configured synthetic IdP origin.
+  --variant <name>     (saml validate) The assertion variant to fetch + validate.
+  --op <op>            (scim provision) create-user | assign-group | deactivate-user.
+  --user-name/--external-id/--email/--display-name/--group  (scim provision) SCIM user/group fields.
+
+Exit codes: 0 success (saml validate: 0 = authenticated) \xB7 1 host/HTTP error or not configured
+            (saml validate: 1 = rejected) \xB7 2 usage error.
+
+Examples:
+  openwop auth status
+  openwop auth saml metadata
+  openwop auth saml login-url --return-to /dashboard
+  openwop auth saml validate --idp-url http://localhost:9100/idp --variant valid
+  openwop auth scim provision --op create-user --user-name jo@acme.com --email jo@acme.com
+`;
+var BASE2 = "/v1/host/sample/auth";
+var SECRET_KEY2 = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential|bearer|assertion|certificate|cert|pem/i;
+function redact2(value) {
+  if (Array.isArray(value)) return value.map(redact2);
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = SECRET_KEY2.test(k) ? "[redacted]" : redact2(v);
+    }
+    return out;
+  }
+  return value;
+}
+async function authRequest(ctx, path, options, notConfiguredMsg) {
+  try {
+    return await requestJson(ctx, path, options);
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      throw new CliError(notConfiguredMsg, 1);
+    }
+    throw err;
+  }
+}
+async function runAuth(ctx, argv) {
+  const sub = argv[0] ?? "status";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, AUTH_HELP);
+    return 0;
+  }
+  if (sub === "saml") {
+    const psub = argv[1] ?? "";
+    const rest = argv.slice(2);
+    if (psub === "metadata") return await runSamlMetadata(ctx, rest);
+    if (psub === "login-url") return await runSamlLoginUrl(ctx, rest);
+    if (psub === "validate") return await runSamlValidate(ctx, rest);
+    throw new CliError(`Unknown auth saml command: ${psub || "(none)"}
+Run \`openwop auth --help\` for usage.`);
+  }
+  if (sub === "scim") {
+    const psub = argv[1] ?? "";
+    if (psub === "provision") return await runScimProvision(ctx, argv.slice(2));
+    throw new CliError(`Unknown auth scim command: ${psub || "(none)"}
+Run \`openwop auth --help\` for usage.`);
+  }
+  if (sub === "status") return await runStatus(ctx, argv.slice(1));
+  throw new CliError(`Unknown auth command: ${sub}
+Run \`openwop auth --help\` for usage.`);
+}
+async function runStatus(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, "Usage: openwop auth status [--json]\n");
+    return 0;
+  }
+  const disc = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
+  const profiles = disc.ok && Array.isArray(disc.body?.capabilities?.auth?.profiles) ? disc.body.capabilities.auth.profiles : [];
+  const samlAdvertised = profiles.includes("openwop-auth-saml");
+  const scimAdvertised = profiles.includes("openwop-auth-scim");
+  const metaReachable = samlAdvertised ? (await probeEndpoint(ctx, `${BASE2}/saml/sso/metadata`)).ok : false;
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, {
+      authProfilesAdvertised: profiles,
+      saml: { advertised: samlAdvertised, ssoMetadataReachable: metaReachable },
+      scim: { advertised: scimAdvertised }
+    });
+    return 0;
+  }
+  const rows = [
+    { surface: "SAML SSO (login/ACS/metadata)", advertised: samlAdvertised ? "yes" : "no", live: !samlAdvertised ? "no" : metaReachable ? "yes" : "seam-only" },
+    { surface: "SCIM provisioning", advertised: scimAdvertised ? "yes" : "no", live: scimAdvertised ? "\u2014" : "no" }
+  ];
+  writeLine(ctx.io.stdout, formatTable(rows, ["surface", "advertised", "live"]));
+  if (!samlAdvertised && !scimAdvertised) {
+    writeLine(ctx.io.stdout, "This host advertises no enterprise-auth profiles (SAML/SCIM are env-gated host-side).");
+  }
+  return 0;
+}
+async function runSamlMetadata(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, "Usage: openwop auth saml metadata [--json]\n");
+    return 0;
+  }
+  const res = await authRequest(ctx, `${BASE2}/saml/sso/metadata`, { auth: false }, "SAML SSO is not configured on this host (set OPENWOP_SAML_*).");
+  const xml = typeof res.body?.raw === "string" ? res.body.raw : typeof res.body === "string" ? res.body : JSON.stringify(res.body);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, { metadata: xml });
+    return 0;
+  }
+  write(ctx.io.stdout, xml.endsWith("\n") ? xml : `${xml}
+`);
+  return 0;
+}
+async function runSamlLoginUrl(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--return-to"] });
+  if (options.help) {
+    write(ctx.io.stdout, "Usage: openwop auth saml login-url [--return-to <path>] [--json]\n");
+    return 0;
+  }
+  const returnTo = options.returnTo ?? "/";
+  const base = ctx.baseUrl.endsWith("/") ? ctx.baseUrl : `${ctx.baseUrl}/`;
+  const url = new URL(`${BASE2}/saml/sso/login?returnTo=${encodeURIComponent(returnTo)}`.replace(/^\//, ""), base);
+  const res = await ctx.fetchImpl(url, { method: "GET", redirect: "manual" });
+  if (res.status === 404) {
+    throw new CliError("SAML SSO is not configured on this host (set OPENWOP_SAML_*).", 1);
+  }
+  const location = res.headers.get("location");
+  if (!location) {
+    throw new CliError(`Expected a redirect to the IdP but got HTTP ${res.status} with no Location header.`, 1);
+  }
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, { loginUrl: location });
+    return 0;
+  }
+  writeLine(ctx.io.stdout, location);
+  return 0;
+}
+async function runSamlValidate(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--idp-url", "--variant"] });
+  if (options.help || options.idpUrl === void 0 || options.variant === void 0) {
+    write(ctx.io.stdout, "Usage: openwop auth saml validate --idp-url <url> --variant <name> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const body = { idpUrl: options.idpUrl, variant: options.variant };
+  let res;
+  try {
+    res = await requestJson(ctx, `${BASE2}/saml/validate`, { method: "POST", body });
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      throw new CliError("SAML validation seam not configured on this host (set OPENWOP_TEST_SAML_IDP_URL).", 1);
+    }
+    if (err instanceof HttpError && err.status === 401) {
+      const reason = err.body?.reason ?? "unauthenticated";
+      if (ctx.json) {
+        writeJson(ctx.io.stdout, redact2({ authenticated: false, reason }));
+        return 1;
+      }
+      writeLine(ctx.io.stdout, `authenticated: no (${reason})`);
+      return 1;
+    }
+    throw err;
+  }
+  const safe = redact2(res.body ?? {});
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, safe);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `authenticated: ${safe.authenticated === true ? "yes" : "no"}`);
+  if (safe.principal !== void 0) writeLine(ctx.io.stdout, `principal: ${typeof safe.principal === "string" ? safe.principal : JSON.stringify(safe.principal)}`);
+  return safe.authenticated === true ? 0 : 1;
+}
+async function runScimProvision(ctx, argv) {
+  const { options } = parseOptions(argv, {
+    bool: ["--help"],
+    value: ["--op", "--user-name", "--external-id", "--email", "--display-name", "--group"]
+  });
+  const OPS = ["create-user", "assign-group", "deactivate-user"];
+  if (options.help || options.op === void 0) {
+    write(ctx.io.stdout, "Usage: openwop auth scim provision --op <create-user|assign-group|deactivate-user> [--user-name <u>] [--external-id <id>] [--email <e>] [--display-name <n>] [--group <g>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!OPS.includes(options.op)) throw new CliError(`--op must be one of ${OPS.join(", ")}`, 2);
+  const user = {};
+  if (options.userName !== void 0) user.userName = options.userName;
+  if (options.externalId !== void 0) user.externalId = options.externalId;
+  if (options.email !== void 0) user.email = options.email;
+  if (options.displayName !== void 0) user.displayName = options.displayName;
+  const body = { op: options.op, user };
+  if (options.group !== void 0) body.group = options.group;
+  const res = await authRequest(ctx, `${BASE2}/scim/provision`, { method: "POST", body }, "SCIM provisioning seam not configured on this host (set OPENWOP_TEST_SCIM_URL).");
+  const safe = redact2(res.body ?? {});
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, safe);
+    return 0;
+  }
+  writeLine(ctx.io.stdout, `op: ${safe.op ?? options.op}`);
+  if (safe.principal) {
+    const p = safe.principal;
+    writeLine(ctx.io.stdout, `principal: ${p.userName ?? p.userId ?? ""}${p.status ? ` (${p.status})` : ""}`);
+    if (Array.isArray(p.groups)) writeLine(ctx.io.stdout, `groups: ${p.groups.length ? p.groups.join(", ") : "(none)"}`);
+  }
+  if (safe.resolvable !== void 0) writeLine(ctx.io.stdout, `resolvable: ${safe.resolvable ? "yes" : "no"}`);
+  return 0;
+}
+
+// src/cli/analytics.ts
+var ANALYTICS_BASE = "/v1/host/sample/analytics/orgs";
+var PUBLIC_BASE = "/v1/host/sample/public-analytics";
+var EVENT_TYPES = ["pageview", "event", "conversion"];
+var ANALYTICS_HELP = `Usage:
+  openwop analytics summary <orgId> [--json]
+  openwop analytics events <orgId> [--json]
+  openwop analytics collect <orgId> --session <key> [--type <t>] [--path <p>] [--name <n>] [--prop k=v]... [--json]
+
+Org-scoped usage analytics (ADR 0018 host extension). Aliased as \`usage\`.
+Endpoints:
+  GET  ${ANALYTICS_BASE}/:orgId/summary   aggregate usage rollup     [authed, workspace:read]
+  GET  ${ANALYTICS_BASE}/:orgId/events    recent raw events (max 100) [authed, workspace:read]
+  POST ${PUBLIC_BASE}/:orgId/collect              record one event           [PUBLIC, unauthed]
+
+This is USAGE / cost / observability \u2014 distinct from \`governance audit\` (the policy-decision
+log). The HOST is the authority: it aggregates server-side and gates each org read by RBAC
+(workspace:read) + the org-tenant's \`analytics\` toggle. This command only RENDERS what the
+host returns; it never computes a rollup locally. When analytics isn't served the host returns
+a uniform 404 and the command fails closed legibly (exit 2).
+
+The public \`collect\` beacon is consent-gated host-side (ADR 0020): a 201 records the event;
+a 202 means analytics consent wasn't granted (honestly reported, not recorded). It is sent
+WITHOUT auth (public path) \u2014 no bearer is attached.
+
+  --session <key>   (collect) The visitor session key (== the consent subject key). Required.
+  --type <t>        (collect) Event type: ${EVENT_TYPES.join(" | ")} (host default: event).
+  --path <p>        (collect) Page path (for pageviews).
+  --name <n>        (collect) Event name.
+  --prop k=v        (collect) A typed property (repeatable; v parsed as number/bool/string).
+  --json            Emit the raw host JSON.
+
+Exit codes: 0 ok \xB7 1 host error \xB7 2 usage error / analytics not served / not authorized.
+
+Examples:
+  openwop analytics summary org_123
+  openwop usage events org_123 --json
+  openwop analytics collect org_123 --session s_abc --type pageview --path /pricing
+`;
+async function analyticsRequest(ctx, path, options) {
+  try {
+    return await requestJson(ctx, path, options);
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      throw new CliError(
+        `Host does not serve analytics for this org (ADR 0018 \u2014 the org-tenant's 'analytics' toggle is off, or the org is unknown). Failing closed.`,
+        2
+      );
+    }
+    throw err;
+  }
+}
+async function runAnalytics(ctx, argv) {
+  const sub = argv[0] ?? "summary";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, ANALYTICS_HELP);
+    return 0;
+  }
+  switch (sub) {
+    case "summary":
+      return await runSummary(ctx, argv.slice(1));
+    case "events":
+      return await runEvents(ctx, argv.slice(1));
+    case "collect":
+      return await runCollect(ctx, argv.slice(1));
+    default:
+      throw new CliError(`Unknown analytics command: ${sub}
+Run \`openwop analytics --help\` for usage.`);
+  }
+}
+async function runSummary(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop analytics summary <orgId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await analyticsRequest(ctx, `${ANALYTICS_BASE}/${encodeURIComponent(positionals[0])}/summary`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const s = res.body?.summary ?? {};
+  writeLine(ctx.io.stdout, `total events: ${s.total ?? 0}`);
+  writeLine(ctx.io.stdout, `sessions: ${s.sessions ?? 0}`);
+  const byType = s.byType ?? {};
+  writeLine(ctx.io.stdout, `by type: ${EVENT_TYPES.map((t) => `${t}=${byType[t] ?? 0}`).join("  ")}`);
+  if (Array.isArray(s.topPaths) && s.topPaths.length) {
+    writeLine(ctx.io.stdout, "top paths:");
+    for (const p of s.topPaths) writeLine(ctx.io.stdout, `  ${p.count}	${p.path}`);
+  }
+  if (Array.isArray(s.utmSources) && s.utmSources.length) {
+    writeLine(ctx.io.stdout, "utm sources:");
+    for (const u of s.utmSources) writeLine(ctx.io.stdout, `  ${u.count}	${u.source}`);
+  }
+  return 0;
+}
+async function runEvents(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop analytics events <orgId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const res = await analyticsRequest(ctx, `${ANALYTICS_BASE}/${encodeURIComponent(positionals[0])}/events`);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const events = Array.isArray(res.body?.events) ? res.body.events : [];
+  if (events.length === 0) {
+    writeLine(ctx.io.stdout, "No analytics events for this org.");
+    return 0;
+  }
+  const rows = events.map((e) => ({
+    ts: e.ts ?? "",
+    type: e.type ?? "",
+    path: e.path ?? e.name ?? "",
+    session: e.sessionKey ?? "",
+    eventId: e.eventId ?? ""
+  }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["ts", "type", "path", "session", "eventId"]));
+  return 0;
+}
+async function runCollect(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, {
+    bool: ["--help"],
+    value: ["--session", "--type", "--path", "--name"],
+    multi: ["--prop"]
+  });
+  if (options.help || positionals.length !== 1 || !options.session) {
+    write(ctx.io.stdout, "Usage: openwop analytics collect <orgId> --session <key> [--type <t>] [--path <p>] [--name <n>] [--prop k=v]... [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  if (options.type !== void 0 && !EVENT_TYPES.includes(options.type)) {
+    throw new CliError(`--type must be one of ${EVENT_TYPES.join(", ")}`, 2);
+  }
+  const body = { sessionKey: options.session };
+  if (options.type !== void 0) body.type = options.type;
+  if (options.path !== void 0) body.path = options.path;
+  if (options.name !== void 0) body.name = options.name;
+  if (Array.isArray(options.prop) && options.prop.length) {
+    const props = {};
+    for (const entry of options.prop) {
+      const eq = String(entry).indexOf("=");
+      if (eq < 0) throw new CliError(`--prop must be <key=value>, got '${entry}'`, 2);
+      const k = entry.slice(0, eq);
+      const raw = entry.slice(eq + 1);
+      props[k] = raw === "true" ? true : raw === "false" ? false : Number.isFinite(Number(raw)) && raw.trim() !== "" ? Number(raw) : raw;
+    }
+    body.props = props;
+  }
+  const res = await analyticsRequest(ctx, `${PUBLIC_BASE}/${encodeURIComponent(positionals[0])}/collect`, {
+    method: "POST",
+    body,
+    auth: false
+  });
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, res.body);
+    return 0;
+  }
+  const r = res.body ?? {};
+  if (r.recorded) {
+    writeLine(ctx.io.stdout, `Recorded event ${r.eventId ?? ""}.`);
+  } else {
+    writeLine(ctx.io.stdout, `Not recorded \u2014 ${r.reason === "consent" ? "analytics consent not granted for this session" : r.reason ?? "declined by host"}.`);
+  }
+  return 0;
+}
+
+// src/cli/proposals.ts
+var PROPOSALS_HELP = `Usage:
+  openwop proposals list [--state <s>] [--kind <k>] [--json]
+  openwop proposals get <proposalId> [--json]
+  openwop proposals revise <proposalId> [--artifact-json '{...}'] [--note <text>] [--json]
+  openwop proposals apply <proposalId> [--json]
+  openwop proposals reject <proposalId> [--note <text>] [--json]
+  openwop proposals archive <proposalId> [--yes]
+
+Reviewable-learning proposals (RFC 0096). An agent's learned change is stored as
+an INERT proposal \u2014 it does nothing until a human applies it. 'list'/'get' render
+the host's review queue. 'revise' edits the stored draft WITHOUT activating it.
+'apply' asks the host to materialize the byte image last persisted on the
+proposal (no re-synthesis) and route activation through the host's advertised
+mode (e.g. an approval-gate) \u2014 the CLI never activates locally. 'reject' declines;
+'archive' soft-deletes.
+
+The host is the authority for every decision \u2014 the CLI renders the host's
+resolved view and relays your verb; it never decides. If the host does not
+advertise the proposal surface (/.well-known/openwop), the group fails closed
+rather than guessing.
+
+Endpoints:
+  list     GET    /v1/host/sample/proposals[?state=&kind=]
+  get      GET    /v1/host/sample/proposals/{id}
+  revise   PATCH  /v1/host/sample/proposals/{id}      (revise; never activates)
+  apply    POST   /v1/host/sample/proposals/{id}/apply
+  reject   POST   /v1/host/sample/proposals/{id}/reject
+  archive  DELETE /v1/host/sample/proposals/{id}      (soft)
+
+  --state <s>          (list) Filter by lifecycle state (e.g. pending, applied, rejected, archived).
+  --kind <k>           (list) Filter by artifact kind (RFC 0096 artifactKinds).
+  --artifact-json J    (revise) The revised draft artifact (validated host-side).
+  --note <text>        (revise/reject) Optional human note recorded with the action.
+  --yes                (archive) Required to confirm the soft-delete.
+  --json               Print the raw host response instead of the rendered view.
+
+Boundary: this is NOT \`approvals\`. Approvals are the human action-queue
+(claim/reject a queued run); proposals are the stored artifact drafts a human
+reviews before they ever become live behavior.
+
+Exit codes (get/apply/reject reflect the proposal's resulting state, so scripts
+can gate on the verdict):
+  0  applied         3  pending (in review)        1  rejected/archived or error
+\`list\` exits 0 on success.
+
+Examples:
+  openwop proposals list --state pending
+  openwop proposals get prop_123 --json
+  openwop proposals revise prop_123 --artifact-json '{"systemPrompt":"..."}'
+  openwop proposals apply prop_123
+  openwop proposals reject prop_123 --note "out of scope"
+  openwop proposals archive prop_123 --yes
+`;
+var SUBCOMMANDS3 = ["list", "get", "revise", "apply", "reject", "archive"];
+async function runProposals(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, PROPOSALS_HELP);
+    return 0;
+  }
+  const args = argv.slice(SUBCOMMANDS3.includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "list":
+      return await runProposalsList(ctx, args);
+    case "get":
+      return await runProposalsGet(ctx, args);
+    case "revise":
+      return await runProposalsRevise(ctx, args);
+    case "apply":
+      return await runProposalsApply(ctx, args);
+    case "reject":
+      return await runProposalsReject(ctx, args);
+    case "archive":
+      return await runProposalsArchive(ctx, args);
+    default:
+      throw new CliError(`Unknown proposals command: ${sub}
+Run \`openwop proposals --help\` for usage.`);
+  }
+}
+function exitForState(state) {
+  if (state === "applied" || state === "active" || state === "installed") return 0;
+  if (state === "pending" || state === "pending-review" || state === "in-review" || state === "draft" || state === "revised") return 3;
+  return 1;
+}
+async function ensureAdvertised3(ctx) {
+  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
+  if (!wk.ok) return;
+  const body = wk.body && typeof wk.body === "object" ? wk.body : {};
+  const advertised = !!(body.capabilities?.agents?.proposals ?? body.agents?.proposals);
+  if (!advertised) {
+    throw new CliError(
+      "proposals: this host does not advertise the reviewable-learning proposal capability (capabilities.agents.proposals is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
+      1
+    );
+  }
+}
+function gate4044(err) {
+  if (err instanceof HttpError && err.status === 404) {
+    const detail = err.body && typeof err.body === "object" && typeof err.body.message === "string" ? err.body.message : "not found";
+    throw new CliError(
+      `proposals: ${detail} (the host must mount /v1/host/sample/proposals; the CLI renders the host's queue, it never decides).`,
+      1
+    );
+  }
+  throw err;
+}
+async function fetchOne(ctx, id) {
+  let res;
+  try {
+    res = await requestJson(ctx, `/v1/host/sample/proposals/${encodeURIComponent(id)}`);
+  } catch (err) {
+    gate4044(err);
+  }
+  return res.body ?? {};
+}
+async function runProposalsList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--state", "--kind"] });
+  if (options.help) {
+    write(ctx.io.stdout, PROPOSALS_HELP);
+    return 0;
+  }
+  await ensureAdvertised3(ctx);
+  const query = [];
+  if (options.state !== void 0) query.push(`state=${encodeURIComponent(options.state)}`);
+  if (options.kind !== void 0) query.push(`kind=${encodeURIComponent(options.kind)}`);
+  const path = `/v1/host/sample/proposals${query.length ? `?${query.join("&")}` : ""}`;
+  let res;
+  try {
+    res = await requestJson(ctx, path);
+  } catch (err) {
+    gate4044(err);
+  }
+  const proposals = Array.isArray(res.body?.proposals) ? res.body.proposals : [];
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, { proposals });
+    return 0;
+  }
+  if (proposals.length === 0) {
+    writeLine(ctx.io.stdout, `No proposals${options.state ? ` in state ${options.state}` : ""}${options.kind ? ` of kind ${options.kind}` : ""} on this host.`);
+    return 0;
+  }
+  const rows = proposals.map((p) => ({
+    proposalId: p.proposalId ?? p.id,
+    state: p.state ?? "",
+    kind: p.kind ?? p.artifactKind ?? "",
+    activation: p.activation ?? "",
+    persona: p.persona ?? p.agentId ?? "",
+    title: truncate3(p.title ?? p.summary ?? "", 40),
+    createdAt: p.createdAt ?? ""
+  }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["proposalId", "state", "kind", "activation", "persona", "title", "createdAt"]));
+  return 0;
+}
+async function runProposalsGet(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop proposals get <proposalId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  await ensureAdvertised3(ctx);
+  const p = await fetchOne(ctx, positionals[0]);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, p);
+    return exitForState(p.state);
+  }
+  renderProposal(ctx, p, positionals[0]);
+  return exitForState(p.state);
+}
+function renderProposal(ctx, p, fallbackId) {
+  writeLine(ctx.io.stdout, `proposalId: ${p.proposalId ?? p.id ?? fallbackId}`);
+  writeLine(ctx.io.stdout, `state: ${p.state ?? ""}`);
+  writeLine(ctx.io.stdout, `kind: ${p.kind ?? p.artifactKind ?? ""}`);
+  if (p.activation) writeLine(ctx.io.stdout, `activation: ${p.activation}`);
+  if (p.persona ?? p.agentId) writeLine(ctx.io.stdout, `persona: ${p.persona ?? p.agentId}`);
+  if (p.title) writeLine(ctx.io.stdout, `title: ${p.title}`);
+  if (p.summary) writeLine(ctx.io.stdout, `summary: ${p.summary}`);
+  if (p.rationale) writeLine(ctx.io.stdout, `rationale: ${p.rationale}`);
+  if (p.installedArtifactRef) writeLine(ctx.io.stdout, `installedArtifactRef: ${p.installedArtifactRef}`);
+  writeLine(ctx.io.stdout, `createdAt: ${p.createdAt ?? ""}`);
+  if (p.revisedAt) writeLine(ctx.io.stdout, `revisedAt: ${p.revisedAt}`);
+  if (p.resolvedAt) writeLine(ctx.io.stdout, `resolvedAt: ${p.resolvedAt}`);
+  if (p.note) writeLine(ctx.io.stdout, `note: ${p.note}`);
+}
+async function runProposalsRevise(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--artifact-json", "--note"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop proposals revise <proposalId> [--artifact-json '{...}'] [--note <text>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const body = {};
+  if (options.artifactJson !== void 0) {
+    try {
+      body.artifact = JSON.parse(options.artifactJson);
+    } catch {
+      throw new CliError("--artifact-json must be valid JSON", 2);
+    }
+  }
+  if (options.note !== void 0) body.note = options.note;
+  if (Object.keys(body).length === 0) throw new CliError("Nothing to revise \u2014 pass --artifact-json and/or --note.", 2);
+  await ensureAdvertised3(ctx);
+  let res;
+  try {
+    res = await requestJson(ctx, `/v1/host/sample/proposals/${encodeURIComponent(positionals[0])}`, { method: "PATCH", body });
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 422) {
+      const detail = err.body?.message ?? "revision rejected (malformed for kind)";
+      throw new CliError(`proposals: ${detail}`, 1);
+    }
+    gate4044(err);
+  }
+  const p = res.body ?? {};
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, p);
+    return exitForState(p.state);
+  }
+  writeLine(ctx.io.stdout, `\u2713 Revised proposal ${p.proposalId ?? p.id ?? positionals[0]} (state ${p.state ?? "unchanged"}; not activated).`);
+  return exitForState(p.state);
+}
+async function runProposalsApply(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop proposals apply <proposalId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  await ensureAdvertised3(ctx);
+  let res;
+  try {
+    res = await requestJson(ctx, `/v1/host/sample/proposals/${encodeURIComponent(positionals[0])}/apply`, { method: "POST" });
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 403) {
+      throw new CliError(`proposals: the host refused to apply ${positionals[0]} \u2014 you lack the scope to activate this proposal (the host is the authority).`, 1);
+    }
+    if (err instanceof HttpError && err.status === 422) {
+      const detail = err.body?.message ?? "proposal is malformed for its kind";
+      throw new CliError(`proposals: ${detail}`, 1);
+    }
+    gate4044(err);
+  }
+  const out = res.body ?? {};
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, out);
+    return out.state ? exitForState(out.state) : 0;
+  }
+  if (out.installedArtifactRef) {
+    writeLine(ctx.io.stdout, `\u2713 Applied proposal ${positionals[0]} \u2192 installed ${out.installedArtifactRef}.`);
+  } else if (out.state === "pending" || out.activation === "approval-gate") {
+    writeLine(ctx.io.stdout, `Proposal ${positionals[0]} routed to the host's activation gate (state ${out.state ?? "pending"}); awaiting approval.`);
+  } else {
+    writeLine(ctx.io.stdout, `\u2713 Applied proposal ${positionals[0]}${out.state ? ` \u2192 ${out.state}` : ""}.`);
+  }
+  return out.state ? exitForState(out.state) : 0;
+}
+async function runProposalsReject(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--note"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop proposals reject <proposalId> [--note <text>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  await ensureAdvertised3(ctx);
+  const body = options.note !== void 0 ? { note: options.note } : void 0;
+  let res;
+  try {
+    res = await requestJson(ctx, `/v1/host/sample/proposals/${encodeURIComponent(positionals[0])}/reject`, { method: "POST", ...body !== void 0 ? { body } : {} });
+  } catch (err) {
+    gate4044(err);
+  }
+  const p = res.body ?? {};
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, p);
+    return exitForState(p.state ?? "rejected");
+  }
+  writeLine(ctx.io.stdout, `\u2713 Rejected proposal ${p.proposalId ?? p.id ?? positionals[0]} \u2192 ${p.state ?? "rejected"}.`);
+  return exitForState(p.state ?? "rejected");
+}
+async function runProposalsArchive(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop proposals archive <proposalId> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) {
+    writeLine(ctx.io.stderr, `Refusing to archive proposal ${positionals[0]} without --yes.`);
+    return 2;
+  }
+  await ensureAdvertised3(ctx);
+  let res;
+  try {
+    res = await requestJson(ctx, `/v1/host/sample/proposals/${encodeURIComponent(positionals[0])}`, { method: "DELETE" });
+  } catch (err) {
+    gate4044(err);
+  }
+  const p = res.body ?? {};
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, p);
+    return exitForState(p.state ?? "archived");
+  }
+  writeLine(ctx.io.stdout, `\u2713 Archived proposal ${p.proposalId ?? p.id ?? positionals[0]} \u2192 ${p.state ?? "archived"}.`);
+  return exitForState(p.state ?? "archived");
+}
+function truncate3(s, n) {
+  return s.length > n ? `${s.slice(0, n - 1)}\u2026` : s;
+}
+
+// src/cli/goals.ts
+var GOALS_HELP = `Usage:
+  openwop goals list [--state <s>] [--json]
+  openwop goals get <goalId> [--json]
+  openwop goals create --objective <text> [--judge host|verifier] [--continuation <mode>]
+                       [--max-iterations <n>] [--max-cost <usd>] [--timeout-ms <ms>] [--json]
+  openwop goals pause <goalId> [--json]
+  openwop goals resume <goalId> [--json]
+  openwop goals abandon <goalId> [--yes]
+
+Standing goals (RFC 0097). A goal is an objective the host pursues across runs
+until a JUDGE (RFC 0090) verdicts it satisfied or a BOUND (RFC 0058) stops it.
+'list'/'get' render the host's goals. 'create' opens a goal with its judge,
+continuation arm(s), and bounds. 'pause'/'resume' suspend/restart continuation;
+'abandon' closes the goal.
+
+Completion is the host judge's verdict \u2014 there is no \`complete\`/\`satisfy\` verb
+and the CLI never sets satisfied; you cannot declare victory from the client. The
+host is the authority; the CLI renders its resolved view and relays your verb. If
+the host does not advertise the goal surface (/.well-known/openwop), the group
+fails closed rather than guessing.
+
+Endpoints:
+  list     GET    /v1/host/sample/goals[?state=]
+  get      GET    /v1/host/sample/goals/{id}
+  create   POST   /v1/host/sample/goals          (422 if the host requires bounds and none given)
+  pause    POST   /v1/host/sample/goals/{id}/pause
+  resume   POST   /v1/host/sample/goals/{id}/resume
+  abandon  POST   /v1/host/sample/goals/{id}/abandon
+
+  --state <s>            (list) Filter by state (e.g. active, satisfied, escalated, bound-exceeded, paused).
+  --objective <text>     (create) The goal objective (required).
+  --judge host|verifier  (create) completion.check \u2014 who decides completion (default: host).
+  --continuation <mode>  (create) continuation.mode \u2014 the arm that re-engages work (e.g. schedule | commitment | manual).
+  --max-iterations <n>   (create) Bound: bounds.maxLoopIterations.
+  --max-cost <usd>       (create) Bound: bounds.maxCostUsd (accumulated USD).
+  --timeout-ms <ms>      (create) Bound: bounds.runTimeoutMs (wall-clock, milliseconds).
+  --yes                  (abandon) Required to confirm.
+  --json                 Print the raw host response instead of the rendered view.
+
+Boundary: a goal is NOT an RFC 0068 commitment \u2014 a goal *uses* a
+commitment/schedule/heartbeat as a continuation arm and adds a judge loop + a
+termination guarantee (bounds).
+
+Exit codes (get/create/pause/resume reflect the goal's state, so scripts can gate
+on the verdict):
+  0  satisfied      3  escalated or still open (active/paused)      1  bound-exceeded/abandoned or error
+\`list\` exits 0 on success.
+
+Examples:
+  openwop goals list --state active
+  openwop goals get goal_123 --json
+  openwop goals create --objective "Keep the triage backlog under 20" --judge verifier --continuation schedule --max-iterations 50 --max-cost 5.00 --timeout-ms 600000
+  openwop goals pause goal_123
+  openwop goals abandon goal_123 --yes
+`;
+var SUBCOMMANDS4 = ["list", "get", "create", "pause", "resume", "abandon"];
+async function runGoals(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, GOALS_HELP);
+    return 0;
+  }
+  const args = argv.slice(SUBCOMMANDS4.includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "list":
+      return await runGoalsList(ctx, args);
+    case "get":
+      return await runGoalsGet(ctx, args);
+    case "create":
+      return await runGoalsCreate(ctx, args);
+    case "pause":
+      return await runGoalsTransition(ctx, args, "pause");
+    case "resume":
+      return await runGoalsTransition(ctx, args, "resume");
+    case "abandon":
+      return await runGoalsAbandon(ctx, args);
+    default:
+      throw new CliError(`Unknown goals command: ${sub}
+Run \`openwop goals --help\` for usage.`);
+  }
+}
+function exitForState2(state) {
+  if (state === "satisfied") return 0;
+  if (state === "escalated" || state === "active" || state === "paused" || state === "running" || state === "pending") return 3;
+  return 1;
+}
+async function ensureAdvertised4(ctx) {
+  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
+  if (!wk.ok) return;
+  const body = wk.body && typeof wk.body === "object" ? wk.body : {};
+  const advertised = !!(body.capabilities?.agents?.goals ?? body.agents?.goals);
+  if (!advertised) {
+    throw new CliError(
+      "goals: this host does not advertise the standing-goals capability (capabilities.agents.goals is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
+      1
+    );
+  }
+}
+function gate4045(err) {
+  if (err instanceof HttpError && err.status === 404) {
+    const detail = err.body && typeof err.body === "object" && typeof err.body.message === "string" ? err.body.message : "not found";
+    throw new CliError(
+      `goals: ${detail} (the host must mount /v1/host/sample/goals; the CLI renders the host's view, it never decides).`,
+      1
+    );
+  }
+  throw err;
+}
+async function runGoalsList(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--state"] });
+  if (options.help) {
+    write(ctx.io.stdout, GOALS_HELP);
+    return 0;
+  }
+  await ensureAdvertised4(ctx);
+  const path = options.state !== void 0 ? `/v1/host/sample/goals?state=${encodeURIComponent(options.state)}` : "/v1/host/sample/goals";
+  let res;
+  try {
+    res = await requestJson(ctx, path);
+  } catch (err) {
+    gate4045(err);
+  }
+  const goals = Array.isArray(res.body?.goals) ? res.body.goals : [];
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, { goals });
+    return 0;
+  }
+  if (goals.length === 0) {
+    writeLine(ctx.io.stdout, `No goals${options.state ? ` in state ${options.state}` : ""} on this host.`);
+    return 0;
+  }
+  const rows = goals.map((g) => ({
+    goalId: g.goalId ?? g.id,
+    state: g.state ?? "",
+    check: g.completion?.check ?? "",
+    objective: truncate4(g.objective ?? "", 40),
+    iterations: progressIterations(g),
+    createdAt: g.createdAt ?? ""
+  }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["goalId", "state", "check", "objective", "iterations", "createdAt"]));
+  return 0;
+}
+function progressIterations(g) {
+  const it = g.progress?.iterations ?? g.iterations;
+  const max = g.bounds?.maxLoopIterations;
+  if (it === void 0) return "";
+  return max !== void 0 ? `${it}/${max}` : String(it);
+}
+async function runGoalsGet(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop goals get <goalId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  await ensureAdvertised4(ctx);
+  let res;
+  try {
+    res = await requestJson(ctx, `/v1/host/sample/goals/${encodeURIComponent(positionals[0])}`);
+  } catch (err) {
+    gate4045(err);
+  }
+  const g = res.body ?? {};
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, g);
+    return exitForState2(g.state);
+  }
+  renderGoal(ctx, g, positionals[0]);
+  return exitForState2(g.state);
+}
+function renderGoal(ctx, g, fallbackId) {
+  writeLine(ctx.io.stdout, `goalId: ${g.goalId ?? g.id ?? fallbackId}`);
+  writeLine(ctx.io.stdout, `state: ${g.state ?? ""}`);
+  if (g.objective) writeLine(ctx.io.stdout, `objective: ${g.objective}`);
+  writeLine(ctx.io.stdout, `completion.check: ${g.completion?.check ?? ""}`);
+  if (g.continuation?.mode) writeLine(ctx.io.stdout, `continuation: ${g.continuation.mode}`);
+  if (g.bounds) {
+    const b = g.bounds;
+    const parts = [
+      b.maxLoopIterations !== void 0 ? `maxLoopIterations=${b.maxLoopIterations}` : null,
+      b.runTimeoutMs !== void 0 ? `runTimeoutMs=${b.runTimeoutMs}` : null,
+      b.maxCostUsd !== void 0 ? `maxCostUsd=${b.maxCostUsd}` : null
+    ].filter(Boolean);
+    writeLine(ctx.io.stdout, `bounds: ${parts.length ? parts.join(", ") : "(none)"}`);
+  }
+  if (g.completion?.lastVerdict) writeLine(ctx.io.stdout, `lastVerdict: ${JSON.stringify(g.completion.lastVerdict)}`);
+  const it = progressIterations(g);
+  if (it) writeLine(ctx.io.stdout, `iterations: ${it}`);
+  if (typeof g.confidence === "number") writeLine(ctx.io.stdout, `confidence: ${g.confidence}`);
+  if (Array.isArray(g.progress?.contributingRunIds)) writeLine(ctx.io.stdout, `contributingRuns: ${g.progress.contributingRunIds.length}`);
+  if (g.finalState) writeLine(ctx.io.stdout, `finalState: ${g.finalState}`);
+  writeLine(ctx.io.stdout, `createdAt: ${g.createdAt ?? ""}`);
+  if (g.closedAt) writeLine(ctx.io.stdout, `closedAt: ${g.closedAt}`);
+}
+async function runGoalsCreate(ctx, argv) {
+  const { options } = parseOptions(argv, {
+    bool: ["--help"],
+    value: ["--objective", "--judge", "--continuation", "--max-iterations", "--max-cost", "--timeout-ms"]
+  });
+  if (options.help || !options.objective) {
+    write(ctx.io.stdout, "Usage: openwop goals create --objective <text> [--judge host|verifier] [--continuation <mode>] [--max-iterations <n>] [--max-cost <usd>] [--timeout-ms <ms>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  if (options.judge !== void 0 && !["host", "verifier"].includes(options.judge)) {
+    throw new CliError("--judge must be one of: host, verifier", 2);
+  }
+  const body = {
+    objective: options.objective,
+    completion: { check: options.judge ?? "host" },
+    continuation: { mode: options.continuation ?? "manual" }
+  };
+  const bounds = {};
+  if (options.maxIterations !== void 0) {
+    const n = Number(options.maxIterations);
+    if (!Number.isInteger(n) || n <= 0) throw new CliError("--max-iterations must be a positive integer", 2);
+    bounds.maxLoopIterations = n;
+  }
+  if (options.maxCost !== void 0) {
+    const c = Number(options.maxCost);
+    if (!Number.isFinite(c) || c < 0) throw new CliError("--max-cost must be a non-negative number (USD)", 2);
+    bounds.maxCostUsd = c;
+  }
+  if (options.timeoutMs !== void 0) {
+    const t = Number(options.timeoutMs);
+    if (!Number.isInteger(t) || t < 0) throw new CliError("--timeout-ms must be a non-negative integer (milliseconds)", 2);
+    bounds.runTimeoutMs = t;
+  }
+  if (Object.keys(bounds).length) body.bounds = bounds;
+  await ensureAdvertised4(ctx);
+  let res;
+  try {
+    res = await requestJson(ctx, "/v1/host/sample/goals", { method: "POST", body });
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 422) {
+      const detail = err.body?.message ?? "this host requires bounds on an active goal \u2014 pass --max-iterations, --max-cost, and/or --timeout-ms";
+      throw new CliError(`goals: ${detail}`, 1);
+    }
+    gate4045(err);
+  }
+  const g = res.body ?? {};
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, g);
+    return exitForState2(g.state);
+  }
+  writeLine(ctx.io.stdout, `\u2713 Created goal ${g.goalId ?? g.id ?? ""} (state ${g.state ?? "active"}, check ${g.completion?.check ?? options.judge ?? "host"}).`);
+  return exitForState2(g.state);
+}
+async function runGoalsTransition(ctx, argv, verb) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, `Usage: openwop goals ${verb} <goalId> [--json]
+`);
+    return options.help ? 0 : 2;
+  }
+  await ensureAdvertised4(ctx);
+  let res;
+  try {
+    res = await requestJson(ctx, `/v1/host/sample/goals/${encodeURIComponent(positionals[0])}/${verb}`, { method: "POST" });
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 409) {
+      const status = err.body?.state;
+      throw new CliError(`goals: cannot ${verb} ${positionals[0]} \u2014 the host reports it is ${status ?? "in a conflicting state"}.`, 1);
+    }
+    gate4045(err);
+  }
+  const g = res.body ?? {};
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, g);
+    return exitForState2(g.state);
+  }
+  writeLine(ctx.io.stdout, `\u2713 ${verb === "pause" ? "Paused" : "Resumed"} goal ${g.goalId ?? g.id ?? positionals[0]} \u2192 ${g.state ?? (verb === "pause" ? "paused" : "active")}.`);
+  return exitForState2(g.state);
+}
+async function runGoalsAbandon(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--yes"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop goals abandon <goalId> [--yes]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!options.yes) {
+    writeLine(ctx.io.stderr, `Refusing to abandon goal ${positionals[0]} without --yes.`);
+    return 2;
+  }
+  await ensureAdvertised4(ctx);
+  let res;
+  try {
+    res = await requestJson(ctx, `/v1/host/sample/goals/${encodeURIComponent(positionals[0])}/abandon`, { method: "POST" });
+  } catch (err) {
+    gate4045(err);
+  }
+  const g = res.body ?? {};
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, g);
+    return exitForState2(g.state ?? "abandoned");
+  }
+  writeLine(ctx.io.stdout, `\u2713 Abandoned goal ${g.goalId ?? g.id ?? positionals[0]} \u2192 ${g.state ?? "abandoned"}.`);
+  return exitForState2(g.state ?? "abandoned");
+}
+function truncate4(s, n) {
+  return s.length > n ? `${s.slice(0, n - 1)}\u2026` : s;
+}
+
+// src/cli/portability.ts
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync9 } from "node:fs";
+import { resolve } from "node:path";
+var EXPORT_HELP = `Usage:
+  openwop export [--kinds <kind>]... [--out <file>] [--json]
+
+Produce a portable ExportBundle of this tenant's reusable estate \u2014 agents, packs,
+schedules, rosters, templates (RFC 0098). The bundle carries REFERENCES only: no
+credential values ever travel in it, just \`secretsToRebind\` refs the operator
+rebinds at the destination. Filter what's included with --kinds (repeatable).
+
+The host produces the bundle; the CLI renders/saves what it returns and runs it
+through a secret redactor first (defense-in-depth \u2014 the bundle is already
+refs-only). Gated on \`capabilities.portability\`; fails closed when the host
+doesn't advertise the surface.
+
+  --kinds <kind>   Limit the export to a kind (repeatable): agent | pack | schedule | roster | template.
+  --out <file>     Write the bundle JSON to a file instead of stdout.
+  --json           Print the raw (redacted) bundle JSON to stdout.
+
+Exit codes: 0 ok \xB7 1 error / surface not served.
+
+Examples:
+  openwop export --json
+  openwop export --kinds agent --kinds schedule --out estate.json
+`;
+var IMPORT_HELP = `Usage:
+  openwop import <bundle-file> [--dry-run] [--json]
+
+Import a portable ExportBundle into this tenant (RFC 0098). ALWAYS dry-run first:
+\`--dry-run\` returns a PLAN \u2014 what would be created / updated / skipped, and any
+CONFLICTS \u2014 and makes ZERO writes. Without --dry-run the host applies the bundle
+idempotently and re-owns every imported entity to your identity.
+
+Secrets are refs, never values: the host rejects (422) a bundle that carries a
+literal credential value before it applies anything; the CLI never prints secret
+material (responses run through a redactor). The result reports \`secretsToRebind\`
+references you bind via the host's credential flow afterward.
+
+  --dry-run   Preview the plan (creates/updates/skips/conflicts); no writes.
+  --json      Print the raw (redacted) plan/result JSON.
+
+Exit codes:
+  0  applied (or a clean dry-run plan)
+  2  the plan has conflicts (nothing destructive was overwritten)
+  1  error \u2014 e.g. the bundle carried a literal credential or a dependsOn cycle (422), or you lack import scope (403)
+
+Examples:
+  openwop import estate.json --dry-run        # preview first (no writes)
+  openwop import estate.json                  # apply (idempotent, re-owned to you)
+`;
+var SECRET_KEY3 = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential/i;
+var REF_ONLY_KEY = /^secretsToRebind$/;
+function redact3(value) {
+  if (Array.isArray(value)) return value.map(redact3);
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = SECRET_KEY3.test(k) && !REF_ONLY_KEY.test(k) ? "[redacted]" : redact3(v);
+    }
+    return out;
+  }
+  return value;
+}
+async function ensureAdvertised5(ctx) {
+  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
+  if (!wk.ok) return;
+  const body = wk.body && typeof wk.body === "object" ? wk.body : {};
+  const advertised = !!(body.capabilities?.portability ?? body.portability);
+  if (!advertised) {
+    throw new CliError(
+      "portability: this host does not advertise the export/import capability (capabilities.portability is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
+      1
+    );
+  }
+}
+function gate4046(err, verb) {
+  if (err instanceof HttpError && err.status === 404) {
+    throw new CliError(
+      `${verb}: the host does not mount /v1/host/sample/${verb} (the CLI renders the host's portability surface, it never fabricates a bundle).`,
+      1
+    );
+  }
+  throw err;
+}
+async function runExport(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--out"], multi: ["--kinds"] });
+  if (options.help) {
+    write(ctx.io.stdout, EXPORT_HELP);
+    return 0;
+  }
+  await ensureAdvertised5(ctx);
+  const kinds = Array.isArray(options.kinds) ? options.kinds : [];
+  const path = kinds.length ? `/v1/host/sample/export?kinds=${encodeURIComponent(kinds.join(","))}` : "/v1/host/sample/export";
+  let res;
+  try {
+    res = await requestJson(ctx, path);
+  } catch (err) {
+    gate4046(err, "export");
+  }
+  const bundle = redact3(res.body ?? {});
+  if (options.out !== void 0) {
+    const dest = resolve(ctx.cwd, options.out);
+    writeFileSync9(dest, `${JSON.stringify(bundle, null, 2)}
+`);
+    writeLine(ctx.io.stdout, `\u2713 Wrote export bundle to ${dest} (${summarizeKinds(bundle)}; refs only, no secret values).`);
+    return 0;
+  }
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, bundle);
+    return 0;
+  }
+  const items = Array.isArray(bundle.items) ? bundle.items : [];
+  if (items.length === 0) {
+    writeLine(ctx.io.stdout, "Export bundle is empty (no exportable estate for the requested kinds).");
+    return 0;
+  }
+  const byKind = {};
+  for (const it of items) byKind[it.kind ?? "unknown"] = (byKind[it.kind ?? "unknown"] ?? 0) + 1;
+  const rows = Object.entries(byKind).map(([kind, count]) => ({ kind, count: String(count) }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["kind", "count"]));
+  const rebind = Array.isArray(bundle.secretsToRebind) ? bundle.secretsToRebind : [];
+  writeLine(ctx.io.stdout, `
+secretsToRebind: ${rebind.length} reference(s)${rebind.length ? ` \u2014 ${rebind.map((r) => r.provider ?? r.ref ?? r).join(", ")}` : ""} (refs only \u2014 bind at the destination).`);
+  if (bundle.source?.origin) writeLine(ctx.io.stdout, `source.origin: ${bundle.source.origin}`);
+  return 0;
+}
+function summarizeKinds(bundle) {
+  const items = Array.isArray(bundle.items) ? bundle.items : [];
+  return `${items.length} item(s)`;
+}
+async function runImport(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help", "--dry-run"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, IMPORT_HELP);
+    return options.help ? 0 : 2;
+  }
+  let bundle;
+  try {
+    const raw = readFileSync9(resolve(ctx.cwd, positionals[0]), "utf8");
+    bundle = JSON.parse(raw);
+  } catch (err) {
+    throw new CliError(`import: could not read bundle file ${positionals[0]} \u2014 ${err instanceof Error ? err.message : "invalid JSON"}`, 2);
+  }
+  await ensureAdvertised5(ctx);
+  const path = options.dryRun ? "/v1/host/sample/import?dryRun=true" : "/v1/host/sample/import";
+  let res;
+  try {
+    res = await requestJson(ctx, path, { method: "POST", body: { bundle } });
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 422) {
+      const detail = err.body?.message ?? "the bundle carried a literal credential value or a dependsOn cycle";
+      throw new CliError(`import: the host refused the bundle (422) \u2014 ${detail}.`, 1);
+    }
+    if (err instanceof HttpError && err.status === 403) {
+      throw new CliError(`import: the host refused the import (403) \u2014 you lack import scope (the host is the authority).`, 1);
+    }
+    gate4046(err, "import");
+  }
+  const out = redact3(res.body ?? {});
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, out);
+    return exitForImport(out);
+  }
+  return options.dryRun ? renderPlan(ctx, out) : renderResult(ctx, out);
+}
+function exitForImport(out) {
+  const conflicts = Array.isArray(out.conflicts) ? out.conflicts : Array.isArray(out.items) ? out.items.filter((i) => i.result === "conflict") : [];
+  return conflicts.length > 0 ? 2 : 0;
+}
+function renderPlan(ctx, plan) {
+  const creates = Array.isArray(plan.creates) ? plan.creates : [];
+  const updates = Array.isArray(plan.updates) ? plan.updates : [];
+  const skips = Array.isArray(plan.skips) ? plan.skips : [];
+  const conflicts = Array.isArray(plan.conflicts) ? plan.conflicts : [];
+  writeLine(ctx.io.stdout, `Import plan (dry-run \u2014 no writes made):`);
+  writeLine(ctx.io.stdout, `  create:   ${creates.length}`);
+  writeLine(ctx.io.stdout, `  update:   ${updates.length}`);
+  writeLine(ctx.io.stdout, `  skip:     ${skips.length}`);
+  writeLine(ctx.io.stdout, `  conflict: ${conflicts.length}`);
+  if (conflicts.length) {
+    writeLine(ctx.io.stdout, `
+Conflicts (resolve before applying \u2014 nothing will be overwritten):`);
+    for (const c of conflicts) writeLine(ctx.io.stdout, `  \xB7 ${c.kind ?? ""} ${c.id ?? c.key ?? ""}${c.reason ? `: ${c.reason}` : ""}`);
+  }
+  const rebind = Array.isArray(plan.secretsToRebind) ? plan.secretsToRebind : [];
+  if (rebind.length) writeLine(ctx.io.stdout, `
+secretsToRebind after apply: ${rebind.length} reference(s) (refs only).`);
+  return exitForImport(plan);
+}
+function renderResult(ctx, result) {
+  const items = Array.isArray(result.items) ? result.items : [];
+  const counts = result.counts ?? tally(items);
+  writeLine(ctx.io.stdout, `Import applied (idempotent; entities re-owned to you):`);
+  writeLine(ctx.io.stdout, `  created: ${counts.created ?? 0}`);
+  writeLine(ctx.io.stdout, `  updated: ${counts.updated ?? 0}`);
+  writeLine(ctx.io.stdout, `  skipped: ${counts.skipped ?? 0}`);
+  if (counts.conflict) writeLine(ctx.io.stdout, `  conflict: ${counts.conflict}`);
+  if (counts.failed) writeLine(ctx.io.stdout, `  failed: ${counts.failed}`);
+  const rebind = Array.isArray(result.secretsToRebind) ? result.secretsToRebind : [];
+  writeLine(ctx.io.stdout, `
+secretsToRebind: ${rebind.length} reference(s)${rebind.length ? ` \u2014 ${rebind.map((r) => r.provider ?? r.ref ?? r).join(", ")}` : ""} (bind via the host's credential flow).`);
+  return exitForImport(result);
+}
+function tally(items) {
+  const c = {};
+  for (const it of items) c[it.result ?? "unknown"] = (c[it.result ?? "unknown"] ?? 0) + 1;
+  return { created: c.created ?? 0, updated: c.updated ?? 0, skipped: c.skipped ?? 0, conflict: c.conflict ?? 0, failed: c.failed ?? 0 };
+}
+
+// src/cli/triggers.ts
+var TRIGGERS_HELP = `Usage:
+  openwop triggers register --source <webhook|email|form> --workflow <id> [--dedup] [--verification <mode>] [--json]
+  openwop triggers list [--state <s>] [--source <s>] [--json]
+  openwop triggers get <subscriptionId> [--json]
+
+External-event trigger subscriptions (RFC 0099). A subscription binds an external
+SOURCE (webhook / email / form) to a WORKFLOW the caller can start; a verified
+inbound event then starts a run with the event as \`ctx.triggerData\`. 'register'
+creates the subscription and returns its source-specific binding (the ingest URL /
+address); 'list'/'get' render the host's subscription state machine
+(active | paused | failed | dead-lettered).
+
+The host is the authority \u2014 it verifies the source, dedups, and runs the durable
+delivery state machine; the CLI renders its resolved view and relays the
+registration. Gated on \`capabilities.triggerBridge\`; fails closed when the host
+doesn't advertise the bridge (or, for register, the requested source under
+\`triggerBridge.ingestion.externalSources\`).
+
+Endpoints:
+  register  POST /v1/trigger-subscriptions
+  list      GET  /v1/trigger-subscriptions
+  get       GET  /v1/trigger-subscriptions/{id}  (falls back to filtering the list)
+
+  --source <s>          (register/list) webhook | email | form.
+  --workflow <id>       (register) The workflow the subscription starts (must be one you can start).
+  --dedup               (register) Enable effectively-once dedup on the subscription.
+  --verification <mode> (register) The host's verification policy (e.g. none | optional | required).
+  --state <s>           (list) Filter by subscription state.
+  --json                Print the raw host response instead of the rendered view.
+
+Secret boundary: a webhook binding secret is returned ONCE at creation \u2014 store it
+then; the CLI never persists it and re-reads show only the secret fingerprint.
+
+Exit codes (get reflects the subscription's state, so scripts can gate):
+  0  active        3  paused        1  failed / dead-lettered or error
+\`list\` exits 0 on success.
+
+Examples:
+  openwop triggers register --source webhook --workflow wf_intake --dedup --verification required
+  openwop triggers list --state active
+  openwop triggers get sub_123 --json
+`;
+var SUBCOMMANDS5 = ["register", "list", "get"];
+async function runTriggers(ctx, argv) {
+  const sub = argv[0] ?? "list";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, TRIGGERS_HELP);
+    return 0;
+  }
+  const args = argv.slice(SUBCOMMANDS5.includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "register":
+      return await runRegister(ctx, args);
+    case "list":
+      return await runList3(ctx, args);
+    case "get":
+      return await runGet4(ctx, args);
+    default:
+      throw new CliError(`Unknown triggers command: ${sub}
+Run \`openwop triggers --help\` for usage.`);
+  }
+}
+function exitForState3(state) {
+  if (state === "active") return 0;
+  if (state === "paused") return 3;
+  return 1;
+}
+async function triggerBridgeCaps(ctx) {
+  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
+  if (!wk.ok) return void 0;
+  const body = wk.body && typeof wk.body === "object" ? wk.body : {};
+  return body.capabilities?.triggerBridge ?? body.triggerBridge ?? null;
+}
+async function ensureAdvertised6(ctx) {
+  const tb = await triggerBridgeCaps(ctx);
+  if (tb === void 0) return;
+  if (!tb) {
+    throw new CliError(
+      "triggers: this host does not advertise the trigger bridge (capabilities.triggerBridge is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
+      1
+    );
+  }
+}
+function gate4047(err) {
+  if (err instanceof HttpError && err.status === 404) {
+    const detail = err.body && typeof err.body === "object" && typeof err.body.message === "string" ? err.body.message : "not found";
+    throw new CliError(
+      `triggers: ${detail} (the host must serve /v1/trigger-subscriptions; the CLI renders the host's subscriptions, it never fabricates one).`,
+      1
+    );
+  }
+  throw err;
+}
+async function runRegister(ctx, argv) {
+  const { options } = parseOptions(argv, {
+    bool: ["--help", "--dedup"],
+    value: ["--source", "--workflow", "--verification"]
+  });
+  if (options.help || !options.source || !options.workflow) {
+    write(ctx.io.stdout, "Usage: openwop triggers register --source <webhook|email|form> --workflow <id> [--dedup] [--verification <mode>] [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  if (!["webhook", "email", "form"].includes(options.source)) {
+    throw new CliError("--source must be one of: webhook, email, form", 2);
+  }
+  const tb = await triggerBridgeCaps(ctx);
+  if (tb) {
+    const ext = tb.ingestion?.externalSources;
+    if (Array.isArray(ext) && !ext.includes(options.source)) {
+      throw new CliError(
+        `triggers: this host does not externally-ingest the '${options.source}' source (capabilities.triggerBridge.ingestion.externalSources = ${JSON.stringify(ext)}).`,
+        1
+      );
+    }
+    if (tb.ingestion === void 0 && tb.supported) {
+      throw new CliError(
+        "triggers: this host advertises triggerBridge but not external ingestion (capabilities.triggerBridge.ingestion is absent) \u2014 it cannot register an external-event subscription.",
+        1
+      );
+    }
+    if (tb.ingestion && tb.ingestion.registrationEndpoint === false) {
+      throw new CliError(
+        "triggers: this host does not serve the registration endpoint (capabilities.triggerBridge.ingestion.registrationEndpoint is false) \u2014 POST /v1/trigger-subscriptions is unavailable here.",
+        1
+      );
+    }
+  } else if (tb === null) {
+    throw new CliError("triggers: this host does not advertise the trigger bridge. The host is the authority \u2014 refusing to guess.", 1);
+  }
+  const body = { source: options.source, workflowId: options.workflow };
+  if (options.dedup) body.dedupEnabled = true;
+  if (options.verification !== void 0) body.verification = { mode: options.verification };
+  let res;
+  try {
+    res = await requestJson(ctx, "/v1/trigger-subscriptions", { method: "POST", body });
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 403) {
+      throw new CliError(`triggers: the host refused the registration (403) \u2014 you cannot bind workflow ${options.workflow} (you must be able to start it; the host is the authority).`, 1);
+    }
+    if (err instanceof HttpError && err.status === 422) {
+      const detail = err.body?.message ?? "registration rejected";
+      throw new CliError(`triggers: ${detail}`, 1);
+    }
+    if (err instanceof HttpError && err.status === 501) {
+      throw new CliError("triggers: the host does not implement the registration endpoint (501) \u2014 it does not advertise triggerBridge.ingestion.registrationEndpoint.", 1);
+    }
+    gate4047(err);
+  }
+  const out = res.body ?? {};
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, out);
+    return exitForState3(out.subscription?.state ?? out.state);
+  }
+  const s = out.subscription ?? out;
+  writeLine(ctx.io.stdout, `\u2713 Registered ${s.source ?? options.source} subscription ${s.subscriptionId ?? s.id ?? ""} (state ${s.state ?? "active"}).`);
+  const binding = out.binding ?? s.binding;
+  if (binding) {
+    if (binding.ingestUrl) writeLine(ctx.io.stdout, `ingestUrl: ${binding.ingestUrl}`);
+    if (binding.ingestAddress) writeLine(ctx.io.stdout, `ingestAddress: ${binding.ingestAddress}`);
+    if (binding.secretFingerprint) writeLine(ctx.io.stdout, `secretFingerprint: ${binding.secretFingerprint}`);
+    if (binding.secret) {
+      writeLine(ctx.io.stdout, `secret: ${binding.secret}`);
+      writeLine(ctx.io.stderr, "\u26A0 This binding secret is shown ONCE and is not stored by the CLI \u2014 copy it now. Re-reading the subscription returns only the fingerprint.");
+    }
+  }
+  return exitForState3(s.state);
+}
+async function fetchList(ctx, query) {
+  const path = `/v1/trigger-subscriptions${query.length ? `?${query.join("&")}` : ""}`;
+  let res;
+  try {
+    res = await requestJson(ctx, path);
+  } catch (err) {
+    gate4047(err);
+  }
+  const b = res.body;
+  return Array.isArray(b?.subscriptions) ? b.subscriptions : Array.isArray(b?.items) ? b.items : Array.isArray(b) ? b : [];
+}
+async function runList3(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"], value: ["--state", "--source"] });
+  if (options.help) {
+    write(ctx.io.stdout, TRIGGERS_HELP);
+    return 0;
+  }
+  await ensureAdvertised6(ctx);
+  const query = [];
+  if (options.state !== void 0) query.push(`state=${encodeURIComponent(options.state)}`);
+  if (options.source !== void 0) query.push(`source=${encodeURIComponent(options.source)}`);
+  const subs = await fetchList(ctx, query);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, { subscriptions: subs });
+    return 0;
+  }
+  if (subs.length === 0) {
+    writeLine(ctx.io.stdout, `No trigger subscriptions${options.state ? ` in state ${options.state}` : ""}${options.source ? ` for source ${options.source}` : ""} on this host.`);
+    return 0;
+  }
+  const rows = subs.map((s) => ({
+    subscriptionId: s.subscriptionId ?? s.id,
+    source: s.source ?? "",
+    state: s.state ?? "",
+    workflow: s.workflowId ?? "",
+    dedup: s.dedupEnabled ? "yes" : "no",
+    createdAt: s.createdAt ?? ""
+  }));
+  writeLine(ctx.io.stdout, formatTable(rows, ["subscriptionId", "source", "state", "workflow", "dedup", "createdAt"]));
+  return 0;
+}
+async function runGet4(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop triggers get <subscriptionId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  await ensureAdvertised6(ctx);
+  const id = positionals[0];
+  let s;
+  try {
+    const res = await requestJson(ctx, `/v1/trigger-subscriptions/${encodeURIComponent(id)}`);
+    s = res.body ?? {};
+  } catch (err) {
+    if (err instanceof HttpError && (err.status === 404 || err.status === 405)) {
+      const found = (await fetchList(ctx, [])).find((x) => (x.subscriptionId ?? x.id) === id);
+      if (!found) throw new CliError(`triggers: no subscription found with id ${id}.`, 1);
+      s = found;
+    } else {
+      gate4047(err);
+    }
+  }
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, s);
+    return exitForState3(s.state);
+  }
+  writeLine(ctx.io.stdout, `subscriptionId: ${s.subscriptionId ?? s.id ?? id}`);
+  writeLine(ctx.io.stdout, `source: ${s.source ?? ""}`);
+  writeLine(ctx.io.stdout, `state: ${s.state ?? ""}`);
+  if (s.workflowId) writeLine(ctx.io.stdout, `workflowId: ${s.workflowId}`);
+  writeLine(ctx.io.stdout, `dedupEnabled: ${s.dedupEnabled ? "yes" : "no"}`);
+  if (s.secretFingerprint) writeLine(ctx.io.stdout, `secretFingerprint: ${s.secretFingerprint}`);
+  if (s.retryPolicy) writeLine(ctx.io.stdout, `retryPolicy: ${JSON.stringify(s.retryPolicy)}`);
+  if (s.lastDelivery) writeLine(ctx.io.stdout, `lastDelivery: ${JSON.stringify(s.lastDelivery)}`);
+  writeLine(ctx.io.stdout, `createdAt: ${s.createdAt ?? ""}`);
+  return exitForState3(s.state);
+}
+
+// src/cli/a2a.ts
+var A2A_HELP = `Usage:
+  openwop a2a status [--json]
+  openwop a2a task <taskId> [--json]
+
+Async / durable A2A tasks (RFC 0100). When a host advertises
+\`capabilities.a2a.durableTasks\`, every backing run has a durable A2ATaskState
+(taskId === runId) that survives caller disconnect, host restart, and HITL pauses.
+'status' shows what the host advertises; 'task' reads one durable task's live
+state.
+
+The host is the authority \u2014 the A2ATaskState is the persisted projection of the
+run's status; the CLI renders it and never derives a task state locally. The
+record is content-free (no run inputs/outputs/artifacts/credentials). Gated on
+\`capabilities.a2a\`; the durable read needs \`durableTasks: true\`. Fails closed
+when the host doesn't advertise A2A.
+
+Endpoints:
+  status   reads /.well-known/openwop \u2192 capabilities.a2a
+  task     GET /v1/host/sample/a2a/tasks/{taskId}
+
+  --json   Print the raw host response instead of the rendered view.
+
+Exit codes (task reflects the A2A task state, so scripts can gate):
+  0  completed
+  3  in progress / needs input (submitted | working | input-required | auth-required)
+  1  failed | canceled | rejected, or error
+\`status\` exits 0 when A2A is advertised, 1 when it is not.
+
+Examples:
+  openwop a2a status
+  openwop a2a task run_abc123 --json
+`;
+var SUBCOMMANDS6 = ["status", "task"];
+async function runA2a(ctx, argv) {
+  const sub = argv[0] ?? "status";
+  if (sub === "--help" || sub === "-h") {
+    write(ctx.io.stdout, A2A_HELP);
+    return 0;
+  }
+  const args = argv.slice(SUBCOMMANDS6.includes(sub) ? 1 : 0);
+  switch (sub) {
+    case "status":
+      return await runStatus2(ctx, args);
+    case "task":
+      return await runTask(ctx, args);
+    default:
+      throw new CliError(`Unknown a2a command: ${sub}
+Run \`openwop a2a --help\` for usage.`);
+  }
+}
+function exitForState4(state) {
+  if (state === "completed") return 0;
+  if (state === "submitted" || state === "working" || state === "input-required" || state === "auth-required") return 3;
+  return 1;
+}
+async function a2aCaps(ctx) {
+  const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
+  if (!wk.ok) return void 0;
+  const body = wk.body && typeof wk.body === "object" ? wk.body : {};
+  return body.capabilities?.a2a ?? body.a2a ?? null;
+}
+async function runStatus2(ctx, argv) {
+  const { options } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help) {
+    write(ctx.io.stdout, A2A_HELP);
+    return 0;
+  }
+  const a2a = await a2aCaps(ctx);
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, { a2a: a2a ?? null });
+    return a2a ? 0 : 1;
+  }
+  if (!a2a) {
+    writeLine(ctx.io.stdout, "This host does not advertise A2A (capabilities.a2a absent).");
+    return 1;
+  }
+  writeLine(ctx.io.stdout, `a2a.supported: ${a2a.supported ? "yes" : "no"}`);
+  if (a2a.agentCardUrl) writeLine(ctx.io.stdout, `agentCardUrl: ${a2a.agentCardUrl}`);
+  writeLine(ctx.io.stdout, `streaming: ${a2a.streaming ? "yes" : "no"}`);
+  writeLine(ctx.io.stdout, `pushNotifications: ${a2a.pushNotifications ? "yes" : "no"}`);
+  writeLine(ctx.io.stdout, `durableTasks: ${a2a.durableTasks ? "yes" : "no"}`);
+  if (!a2a.durableTasks) writeLine(ctx.io.stdout, "(durable task reads require durableTasks: true)");
+  return 0;
+}
+async function runTask(ctx, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"] });
+  if (options.help || positionals.length !== 1) {
+    write(ctx.io.stdout, "Usage: openwop a2a task <taskId> [--json]\n");
+    return options.help ? 0 : 2;
+  }
+  const a2a = await a2aCaps(ctx);
+  if (a2a === null) {
+    throw new CliError("a2a: this host does not advertise A2A (capabilities.a2a absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.", 1);
+  }
+  if (a2a && a2a.durableTasks === false) {
+    throw new CliError("a2a: this host advertises A2A but not durable tasks (capabilities.a2a.durableTasks is false) \u2014 there is no durable task to read.", 1);
+  }
+  const id = positionals[0];
+  let t;
+  try {
+    const res = await requestJson(ctx, `/v1/host/sample/a2a/tasks/${encodeURIComponent(id)}`);
+    t = res.body ?? {};
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      throw new CliError(`a2a: no durable task ${id} (the host must serve /v1/host/sample/a2a/tasks/{taskId}; taskId equals the backing runId).`, 1);
+    }
+    throw err;
+  }
+  if (ctx.json) {
+    writeJson(ctx.io.stdout, t);
+    return exitForState4(t.state);
+  }
+  writeLine(ctx.io.stdout, `taskId: ${t.taskId ?? id}`);
+  writeLine(ctx.io.stdout, `runId: ${t.runId ?? ""}`);
+  writeLine(ctx.io.stdout, `state: ${t.state ?? ""}`);
+  if (t.interruptKind) writeLine(ctx.io.stdout, `interruptKind: ${t.interruptKind}`);
+  if (t.contextId) writeLine(ctx.io.stdout, `contextId: ${t.contextId}`);
+  if (t.pushConfig) writeLine(ctx.io.stdout, `pushConfig: ${JSON.stringify(t.pushConfig)}`);
+  writeLine(ctx.io.stdout, `updatedAt: ${t.updatedAt ?? ""}`);
+  return exitForState4(t.state);
+}
+
 // src/cli.ts
 async function runCli(argv, options = {}) {
   const io = options.io ?? {
@@ -6780,6 +10658,46 @@ async function runCli(argv, options = {}) {
         return await runAccount(ctx, commandArgs);
       case "admin":
         return await runAdmin(ctx, commandArgs);
+      case "governance":
+      case "policy":
+        return await runGovernance(ctx, commandArgs);
+      case "approvals":
+      case "approval":
+        return await runApprovals(ctx, commandArgs);
+      case "consent":
+        return await runConsent(ctx, commandArgs);
+      case "mcp":
+        return await runMcp(ctx, commandArgs);
+      case "connections":
+      case "conn":
+        return await runConnections(ctx, commandArgs);
+      case "profiles":
+        return await runProfiles(ctx, commandArgs);
+      case "toggles":
+        return await runToggles(ctx, commandArgs);
+      case "users":
+        return await runUsers(ctx, commandArgs);
+      case "workforces":
+      case "fleet":
+        return await runWorkforces(ctx, commandArgs);
+      case "auth":
+      case "sso":
+        return await runAuth(ctx, commandArgs);
+      case "analytics":
+      case "usage":
+        return await runAnalytics(ctx, commandArgs);
+      case "proposals":
+        return await runProposals(ctx, commandArgs);
+      case "goals":
+        return await runGoals(ctx, commandArgs);
+      case "export":
+        return await runExport(ctx, commandArgs);
+      case "import":
+        return await runImport(ctx, commandArgs);
+      case "triggers":
+        return await runTriggers(ctx, commandArgs);
+      case "a2a":
+        return await runA2a(ctx, commandArgs);
       default:
         throw new CliError(`Unknown command: ${command}
 Run \`openwop --help\` for usage.`);
@@ -6846,7 +10764,30 @@ function showHelp(io, command) {
     prompt: PROMPTS_HELP,
     notify: NOTIFY_HELP,
     account: ACCOUNT_HELP,
-    admin: ADMIN_HELP
+    admin: ADMIN_HELP,
+    governance: GOVERNANCE_HELP,
+    policy: GOVERNANCE_HELP,
+    approvals: APPROVALS_HELP,
+    approval: APPROVALS_HELP,
+    consent: CONSENT_HELP,
+    mcp: MCP_HELP,
+    connections: CONNECTIONS_HELP,
+    conn: CONNECTIONS_HELP,
+    profiles: PROFILES_HELP,
+    toggles: TOGGLES_HELP,
+    users: USERS_HELP,
+    workforces: WORKFORCES_HELP,
+    fleet: WORKFORCES_HELP,
+    auth: AUTH_HELP,
+    sso: AUTH_HELP,
+    analytics: ANALYTICS_HELP,
+    usage: ANALYTICS_HELP,
+    proposals: PROPOSALS_HELP,
+    goals: GOALS_HELP,
+    export: EXPORT_HELP,
+    import: IMPORT_HELP,
+    triggers: TRIGGERS_HELP,
+    a2a: A2A_HELP
   };
   write(io.stdout, map[command] ?? ROOT_HELP);
   return 0;
@@ -6933,8 +10874,9 @@ Commands:
   webhooks add        Register a webhook subscription
   webhooks remove     Delete a webhook subscription
   webhooks test       Fire a signed test delivery
-  cron list           List scheduled (cron) jobs
+  cron list           List scheduled (cron) jobs (--roster <id> to filter)
   cron add            Schedule a cron job
+  cron enable|disable Toggle a scheduled job active/inert
   cron remove         Delete a scheduled job
   cron trigger        Fire a scheduled job once now
   messaging connectors  Manage messaging relay connectors
@@ -6961,7 +10903,31 @@ Commands:
   media generate-image  Generate an image via the demo media route (stubbed)
   media transcribe    Transcribe an audio file (stubbed)
   media synthesize    Synthesize speech from text (stubbed)
+  governance policy   Get/set tenant governance policy (alias: policy)
+  governance audit    Read the host audit log (tenant-scoped)
   conformance         Run the OpenWOP conformance CLI from this repo
+  approvals list      List the approval inbox (agents propose, humans dispose)
+  approvals claim     Approve a proposal (starts the run); reject to dismiss
+  consent policy      Show/set the tenant consent policy (org-scoped)
+  consent records     List or read tenant consent records (+ GDPR erase)
+  consent public      Read/record a visitor's consent (public, unauthed)
+  mcp tools|resources|prompts  MCP client for the host JSON-RPC server mount (RFC 0020)
+  connections list    List host connections + status (test/authorize; alias: conn)
+  connections authorize  Mint an OAuth consent URL for a provider (URL only)
+  profiles me         Show/edit your self-service profile (persona/skills/portfolio)
+  profiles get        View a tenant member's profile; endorse/pin via subcommands
+  toggles list|get    Render the host's resolved feature-toggle assignments (read-only)
+  users list|me       Tenant identity directory + account lifecycle (not RBAC; see orgs)
+  workforces list     List governed workforces (durable orchestration; alias: fleet)
+  workforces metrics  Aggregate telemetry + governance/autonomy for a workforce
+  auth status         Enterprise SSO/SAML/SCIM status + SP metadata (alias: sso)
+  auth saml|scim      SAML SSO metadata/login/validate; SCIM provisioning seam
+  analytics summary   Org-scoped usage analytics: summary/events + public collect (alias: usage)
+  proposals list      Reviewable-learning proposals (RFC 0096): list/get/revise/apply/reject/archive
+  goals list          Standing goals (RFC 0097): list/get/create/pause/resume/abandon \u2014 judge-based completion
+  export / import     Agent-platform portability (RFC 0098): export a refs-only bundle; import --dry-run then apply
+  triggers register   External-event trigger subscriptions (RFC 0099): register/list/get a source\u2192workflow binding
+  a2a task            Async/durable A2A tasks (RFC 0100): read a durable task's live state (+ a2a status)
 
 Examples:
   openwop onboard